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5.6.3.2.9.5 (U) EXAMPLE 5 


(U/FOGO) 


5.6.3.3 (U) TYPE 4 ASSESSMENTS 


(U) Type 4 Assessment defined: Obtain and retain information to inform or facilitate 
intelligence analysis and planning. [AGG-Dom. Part IV] 


(U/PO8O) A Type 4 Assessment may be opened to obtain information that informs or 
facilitates the FBI’s intelligence analysis and planning functions. The authorized purpose and 
clearly defined objective(s) of a Type 4 Assessment must be based on. or related to, the need 
to collect or acquire information for current or future intelligence analysis and planning 
purposes. An Assessment under this section, oftentimes referred to as a “domain 
Assessment,” may lead to the identification of intelligence gaps, the development of FBI 
collection requirements, or the opening of new Assessments or Predicated Investigations. 


(U/-FEE6} A Type 4 Assessment is not threat specific; threat-based Assessments are opened 
and governed by DIOG Section 5.6.3.2 (Type 3 Assessment). While no particular factual 
predication is required for a Type 4 Assessment. the Assessment cannot be based solely on 
the exercise of First Amendment protected rights or on race, ethnicity, gender. national origin, 
religion, sexual orientation. or gender identity, or a combination of only such factors. 


(U//#Q40) Whenever a Type 4 Assessment identifies and begins to focus on specific 
individual(s), group(s). or organization(s). whose activities may constitute a violation of 
Federal criminal law or a threat to the national security, a separate Type 1 & 2 Assessment or 
a Predicated Investigation must be opened. Similarly. if a Type 4 Assessment identifies a 
particular national security or criminal threat within the AOR, or identifies victims or targets 
within an AOR who are vulnerable to any actual or potential threat, a separate Type 3 
Assessment or Predicated Investigation must be opened. 


(U//FQUO) A Type 4 Assessment may not be used for the purpose of collecting positive 
foreign intelligence (PFI), although such intelligence may be incidentally collected. Positive 
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foreign intelligence can only be intentionally collected pursuant to DIOG Sections 5.6.3.5 
(Type 6 Assessment) and/or Section 9. 


(UFFOERS) See Section 5.11 below for intelligence collection, (i.e., incidental collection) and 


5.6.3.3.1 (U) DURATION 


b7E 


(UFOO) A Type 4 Assessment may only be opened with prior supervisor approval. The 
effective date of the Assessment is the date the final approval authority approves the EC as 
specified in Section 5.6.2 above. A Type 4 Assessment may continue for as long as necessary 
to achieve its authorized purpose and clearly defined objective(s). Although a Type 4 
Assessment is not limited in duration, when the clearly defined objective(s) have been met. 
the Assessment must be closed with an EC approved by the supervisor. 


5.6.3.3.2 (U) DOCUMENTATION 
(U/FOBO} b7E 


(U//FOO) 


U//FQUSO) This = of Assessment must be documented in the appropriate 


(U//FOYO) Note: Investigative activity must not be conducted? out | BIE 
5.6.3 (U) APPROVAL 


(U//FOHO7 All Type 4 Assessments must be approved in advance by a supervisor and opened 
by an EC. Notwithstanding any other provision in the DIOG. a Type 4 A ment cannot be 
opened based on oral approval. The supervisor must approve a Type 4 A ment in 
accordance with the standards discussed in DIOG Section 5.5. Additional approval 
requirements apply to SIMs. as described below. 


5.6.3.3.4 (U) SENSITIVE INVESTIGATIVE MATTERS (SIM) 


(U//EQUO) If the Assessment involves a sensitive investigative matter (SIM), the CDC must 
review and the SAC must approve the Assessment prior to opening. If a SIM arises after the 
opening of a Type 4 Assessment, Assessment activity may continue, but the matter must be 
documented in an EC reviewed by the CDC and approved by the SAC as soon as practicable. 
but not more than five (5) business days after the SIM arises. The term “sensitive 
investigative matter” is defined in DIOG Section 5.7 and Section 10. 


i) bTE 
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5.6.3.3.5 (U) NOTICE 


(UEOB O) There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 4 Assessments. 


5.6.3.3.6 (U) FILE REVIEW 


(U/FEUC) A Type 4 Assessment requires a file review in accordance with DIOG Section 
3.4.4. 


5.6.3.3.7 (U) RESPONSIBLE ENTITY 


(U/FOEO) A Type 4 Assessment may only be opened by the DI. a Regional Intelligence 
Group. a FIG. or FBIHQ Domain/Strategic intelligence components within the operational 
divisions. 

5.6.3.3.8 (U) TYPE 4 ASSESSMENT CLOSING 
(U//FƏ8O) See DIOG subsections 5.12.1 and 5.12.1.2 below for guidance on closing a Type 
4 Assessment. 


5.6.3.3.9 (U) EXAMPLES OF TYPE 4 ASSESSMENTS 
5.6.3.3.9.1 (U) EXAMPLE 1 


U/OVO) 


5.6.3.3.9.2 (U) EXAMPLE 2 
(U// 


(U/FERO 
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5.6.3.3.9.3 (U) EXAMPLE 3 
(Uh 
U/ 
5.6.3.3.9.4 (U) EXAMPLE 4 
(U/ 


5.6.3.4 (U) TYPE 5 ASSESSMENTS 


(U) Type 5 Assessment defined: Seek information to identify potential human sources, 
assess their suitability. credibility, or value of individuals as human sources. 

(UHFEG6) A Type 5 Assessment provides the authority and a mechanism to identify. 
evaluate and recruit a Potentia fidential Human Source (CHS) prior to opening and 
operating them as a CHS in| e 5 Assessment is not a prerequisite to opening an 
individual as an operational CHS i f the necessary information for opening has been 
obtained through other methods (e.g., following arrest. an individual agrees to become as 
CHS). 


(U/FOH63 A Type 5 Ass 
A) (UEY) On a specific named individual who is a potential CHS (PCHS); or 


B) (U/#@00) Without a specific named individual. if the goal is to identify individuals with 
placement and access to particular information. 


sment may be opened: 
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(U/OH6) Type 5 Assessment activities may not be based solely on race. ethnicity, gender, 
national origin, religion, sexual orientation, or gender identity or rights protected by the First 
Amendment, or a combination of only such factors. 


b7E 


(UFO) There are three phases of a Type 5 Assessment. The ph: 
Phase, (2) Evaluation Phase. and (3) Recruitment Phase. A Type 5 Assessment opened on a 
specific named individual may only use the Evaluation and Recruitment phases as described 
below. A Type 5 Assessment opened without a specific named individual is limited to the 
Identification Phase only. Once the Identification Phase has succeeded in identifying specific 
individuals who might have appropriate placement and access, the FBI employee must open a 
new separate Type 5 Assessment on any individual the employee wishes to further evaluate 
and possibly recruit as a CHS. The original Type 5 Assessment without a specific named 
individual may remain open in the Identification Phase. if the authorized purpose and clearly 
defined objective(s) still exist. 


re: (1) Identification 


5.6.3.4.1 (U) PHASES OF TYPE 5 ASSESSMENTS 
5.6.3.4.1.1 (U/EB@RO) IDENTIFICATION PHASE 


(UEY) This phase may be used by an SA assigned to cither a HUMINT or 
investigative squad or by an IA assigned to the ficld office or FBIHQ to identify PCHSs 
who seem likely to have placement and access to information or intelligence related to 
criminal or national security threats, or investigations, without naming a specific 
individual. The goal of this phase is to identify individuals with CHS potential, who may 
then be evaluated and recruited under the Evaluation and Recruitment Phases of a Type 5 
Assessment. 


(U//BQHO) This phase is initiated with the approval of a CHS identification plan. The 
plan, which must be based on a thorough review of available intelligence and information 
regarding the threat or investigation at issue. must specify characteristics of individuals 
likely to have CHS potential, and the investigative methods (c.g.. database scarches, 
surveillance of specific locations, attendance at specific events) that will be used to 
identify individuals with those characteristics. Selection of characteristics/search criteria 
must have a logical connection to intelligence or known facts. and may not be based 
merely on conjecture. In addition, selected characteristics may not be based solely on 
race, ethnicity. gender. national origin. religion, sexual orientation, or gender identity, or 
rights protected under the First Amendment or a combination of only such factors. See 
DIOG Section 4 for further explanation on the permissible use of race, ethnicity, gender, 
national origin. religion, sexual orientation. or gender identity or rights protected under 
the First Amendment. The investigative methods that may be used to identify individuals 
with the specified characteristics needed must also be based on existing intelligence and 
be reasonably likely to yield individuals with the specified characteristics. 


(U/POUO) If necessary. after a CHS identification plan has been approved, and a group 
of individuals who potentially have placement and access to the relevant information 
have been identified, the SA or JA may, with authorization set forth in subsection 
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5 3.1. use additional characteristics to narrow the group of individuals to those most 
likely to have the desired placement and access. An intelligence product may be produced 
during the Identification Phase describing the results of, or analysis generated during, the 
Identification Phase. The product may be based upon analysis of the group’s 
characteristics or search criteria that my yield insight into previously unknown 
similarities, activities or patterns of conduct. If any additional investigative methods are 
sought that will focus on an individual, then an Evaluation Phase must be opened. Any 


product produced must be documented in thi and b7E 
approved and disseminated in accordance wit! 


(U/HROYO9) Once an SA or IA has narrowed the field to one or more known persons who 
appear to have potential as CHSs, in order to gather additional information regarding 
background and authenticity or. in order for an SA to undertake efforts to recruit the 
individual, a Type 5 Assessment must be opened on the specific named individual(s) in 
accordance with subsection 5.6.3.4.1.2, below. 


5.6.3.4.1.2 (U/FFO@BO) EVALUATION PHASE 


(U/FƏ89) This phase may be used by an SA assigned to either a HUMINT or 
investigative squad or by an IA assigned to the field office or FBIHQ to evaluate a known 
individual believed to have placement and access so that the individual, if successfully 
recruited, can provide the FBI with information of value. The goal of this phase of a Type 
5 Assessment is to gather information, through the use of the investigative methods set 
forth in subsection 5.6.3.4.8, below regarding background, authenticity, and suitability of 
a particular PCHS (specific named individual). An IA who develops information during 


this phase that indicates a PCHS is worthy of recruitment should prepare {| Bus 
net © use by an SA on the appropriate HUMINT or 

investigative squad to recruit the individual. Note: A| ay be prepared by other FBI 

employces assigned to the evaluation phase Type 5 as case participants. However, the 

Assessment’s assigned case manager(s) remains responsible for the content of th¢___] If 

information developed during this phase indicates the individual should not be recruited 

as a CHS, the Type 5 Assessment must be closed. 


5.6.3.4.1,.3 (U/FOUO RECRUITMENT PHASE 


(UBWO) This phase may only be used by an SA assigned to a HUMINT or 
investigative squad. The goal of this phase of a Type 5 Assessment is to recruit the PCHS 
to become an operational CHS, and therefor, ruilment phase may focus only on a 
specific named individual. Information ie other information/intelligence 
available to the SA may be uscd during the recruitment phase. If the recruitment is 
successful, the Type 5 Assessment must be closed (Sce Section 5.6.3.4.9, below) and the 
individual opened as a CHS i The Type 5 Assessment must also be closed if the 
recruitment is not successful, either because the individual declines to become a CHS or a 
determination is made not to continue the recruitment. 


5.6.3.4.2 (U) DURATION 


b7E 


(U/ÆOY9) The effective date of a Type 5 Assessment is the date the highest level of 
authority required approves the opening EC | A Type 5 
Assessment may continue for as long as necessary to achieve its authorized purpose and 
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clearly defined objective(s) as set forth in the three phases above or when it is determined that 
the individual named subject cannot or should not be recruited as a CHS. 


5.6.3.4.3 (U) DOCUMENTATION 


5.6.3.4.3.1 (U//FORE) IDENTIFICATION PHASE 
UFOO: 


A) (UHO; 


(U/FOYG) 


B) (U/4 


(U/FOYE 


C) (U//Feve) 


(U// FORO) 
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(UAPOHO) If a Type 5 Assessment has already been opened and an JA or SA wishes to 
utilize additional characteristics/search criteria or investigative methods in the 
Identification Phase that were not documented in the opening EC, the additional 
characteristics/scarch criteria and/or investigative methods must be documented by EC 


5.6.3.4.3.2 (UEO) EVALUATION/RECRUITMENT PHASES 


(U//BOUO) A Type 5 Assessment opened to evaluate and/or recruit a specific person as a 
CHS must be opened with an EC (or lusing the appropriate 


sommo cc 


5.6.3.4.4 (U) APPROVAL 


(U//FOGO) A Type 5 Assessment must be approved by the appropriate supervisor and opened 
with an EC er = Notwithstanding any other provision in the DIOG, a 
Type 5 Assessment cannot be opened on oral approval. For SAs. a Type 5 Assessment must 
be approved by thcir SSA. For IAs, a Type 5 Assessment must be approved by the SIA and 
the SSA on the HUMINT or investigative squad that will potentially recruit the individual. An 
SSA and/or SIA must use the standards provided in DIOG Section 5.5 when deciding whether 
to approve a Type 5 Assessment. Additional approval requirements apply to Sensitive PCHSs. 
as described below. 


5.6.3.4.4.1 (U) CONFLICT RESOLUTION 


(UAFOS) If there is any conflict between thd p any other PG and 
the DIOG, the DIOG controls. OGC, OIC and IPO should be immediately notified of any 
such conflict. 
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5.6.3.44.2 (U/AFQEO) SENSITIVE POTENTIAL CHSS AND GROUPS 


(U//EO%0} CDC review and SAC approval is required before a Type 5 Assessment may 
be opened on a Sensitive PCHS or if. during the Identification Phasc, a sensitive 
characteristic is at least one aspect being used to identify individuals with potential 
placement and access to information of interest. If it is determined after opening a Type 5 
Assessment that a PCHS is Sensitive or that a sensitive characteristic must be added to 
the PCHS Identification Plan. the Assessment activity may continue. but the matter must 
be documented inan EC (ofS and reviewed by the CDC and 
approved by the SAC as soon as practicable, but not more than f is 
determination. Additionally, if the Type 5 Assessment involves] 


A Sensitive PCHS or sensitive characteristic (as part ofan 
Identification Plan) is defined as follows: 


A) (UAFEH6) A domestic public official (other than a member of the U.S. Congress or White 
House Staff — which requires higher approval authority, Se prema erro er 


for additional details); 

B) (U//FE8@) A domestic political candidate; 

C) (U//FQ8@) An individual prominent within a religious organization; 

D) (U/42640) An individual prominent within a domestic political organization; 
E) (U/A*@40) A member of the news media; or 


pue OUUM 
(U//FOC) DIOG Section 10 should be consulted for a definition of these terms. 


(UFOO) For additional information regarding Sensilive PCHSs see CHSPG. Part 2, 
DIOG Section 10.1.4 and OG Appendix G - Cle 


5.6.3.4.5 (U) NOTICE 


(UEOB There is no requirement to provide notice to FBIHQ or DOJ of opening or closing 
Type 5 Assessments. 


5.6.3.4.6 (U) FILE REVIEW 
(U//BOUOF The frequency of a supervisory file review must be in accordance with DIOG 
subsection 3.4.4.7. Sef oe Type 5 file review procedures. 


(U//FEBO) The Type 5 Assessment file review must be documented]____| Because 
Type 5 Assessments are confidential. the[_|File Review must not reveal information 
that could identify the PCHS. 
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5.6.3.4.7 (U) RESPONSIBLE ENTITY 


(U/ESHYO7 A Type 5 Assessment without a specific named individual may be opened by SAs 
on HUMINT, investigative squads or FBIHQ, or IAs assigned to a field office or to FBIHQ. A 
Type 5 Assessment on specific named individual may be opened by SAs on HUMINT or 
investigative squads, and by IAs (evaluation phase only) assigned to the field office 
HUMINT. investigative squads, or at FBIHQ. 


5.6.3.4.8 (U) AUTHORIZED INVESTIGATIVE METHODS IN TYPE 5 ASSESSMENTS 


(U//PFERO) Only the following investigative methods may be used in a Type 5 A sment, 
whether in the identification. evaluation, or recruitment phase. All of these investigative 
methods may be used by SAs. IA’s may only use investigative methods (A) through (F). 


A) (U//FE88) Public information; 
B) (U/O88) Records or information — FBI and DOJ; 


C) (UOVO) Records or information - Other Federal, state, local, tribal, or foreign government 
agencies; 
D) (U/FƏUQ) On-line services and resources; 
E) (U/AF@RS) Information voluntarily provided by governmental or private entitics; 
F) (U//FE#9) Use of AFID or the Covert Approach is only permitted for use during approved 
activity in a Type 5 Assessment (See the note below and th¢_ | b7E 
G) (U/EOYO) CHS use and recruitment; 
H) (UVEOYO) Interview or request information from the public or private entitics; 
D (U/FO¥6) Physical surveillance (not requiring a court order); 


J) (U/L200) Polygraph examinations (ef 


K) (U/S) Trash Covers (Searches that do not require a warrant or court order) (Note: SSA 
approval and consultation with CDC/OGC is required prior to use of this method. See DIOG 
Section 18.6.12.5). 


(U//FE8C) Note: Consent Searches are authorized in Assessments.” 

(U//FOBO) Some investigative methods used during Assessments that may require higher 
supervisory approval are set forth in DIOG Section 18.5. 

(U/2OH@) In addition. as specified in division PGs, there may be agreements (e.g. 
Memoranda of Understanding, etc.) that require additional coordination and approval prior to 
conducting certain activities. 


usso OOOO S o 


E we ad 


(UFOO Note: The Covert Approach, which may beg ized in an approved Type 5 
Assessment, pursuant to the procedures detailed in th s not undercover activity 
subject to the provisions of DIOG Section 18.6.13. The distinction between the Covert 


° (U/ PERS) The DOJ has opined that Consent Searches are authorized in Assessments, as well as in 
Predicated Investigations. 
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Approach and undercover activity lies in the authorized purpose of the Type 5 Assessment, 
which is to seek information to identify, evaluate, and recruit an individual as a CHS, not to 
seck information relevant to federal crimes or national security threats. See also DIOG 
appendix G. 


(UAPOGO) Additionally. in the course of a predicated investigation, an agent cannot utilize 
undercover activity (up to five times pursuant to UCO guidelines), with the specific purpose 
to identify, evaluate or recruit a PCHS. The agent musi 


(UFOO) 


(U/FOCOF, 


5.6.3.4.9 (U) CLOSING TYPE 5 ASSESSMENTS 
(U/EOHOTA Type 5 Assessment must be closed under the following circumstances: 


A)(U//FO6) In a Type 5 Assessment opened without a specific named individual. it is 
determined that the characteristics/search criteria used to identify individuals with 
placement and access to needed information have not succeeded in identifying such 
individuals. or the FBI no longer has a need for a CHS with the specified placement 

. Additionally, the closing EC must document the factual basis for closing 

ment; 


B) (U//FORO) The Identification Phase has succeeded in identifying specific named 
individuals who might have appropriate placement and access. If the FBI wishes to 
further evaluate and possibly recruit any such identified individuals. a separate Type 5 
Assessment must be opened on that person. The original Type 5 Assessment may 
remain open in the identification phase if the authorized purpose and clearly defined 
objective still exist. Additionally. the closing EC must document the factual basis for 
closing the Assessment; 


C) (U/-FOHO) In a Type 5 Assessment opened on a specific named individual. it is 
determined that the PCHS is not a suitable candidate for further evaluation and/or 
recruitment efforts. Additionally, the closing EC must document the factual basis for 
closing the Assessment; 


D)(U//BO8} In a Type 5 Assessment opened on a specific named individual, SA 

recruitment efforts are successful and the PCHS has been opened as a CHS in 
Once the successfully recruited peHs L is opened, all documents 
ee in the Type 5 Assessment must be maintained in the CHS’ open| 


or 
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E) (U/FOUS} In a Type 5 Assessment opened on a specific named individual, SA 
efforts to recruit the PCHS have been unsuccessful or it is determined that further 
recruitment efforts are not likely to be successful. Additionally, the closing EC must 
document the factual basis for closing the Assessment. 


(U) See also DIOG subsection 5.12.1.3 below for properly marking a closed Type 5 
Assessment that contains personal information. 


5.6.3.4.9.1 (U) CLOSING APPROVAL FOR TYPE 5 ASSESSMENTS 


(U/BOUE) Type 5 Assessments must be closed, via EC, with SSA approval. if it was 
opened by an SA. Type 5 Assessments must be closed with SIA and SSA approval. if it 
was opened by an IA. 


5.6.3.4.10 (U) EXAMPLES OF TYPE 5 ASSESSMENTS 


5.6.3.4.10.1 (U/FFQBO) EXAMPLES OF A TYPE 5 ASSESSMENT OPENED 
WITHOUT A SPECIFIC NAMED INDIVIDUAL 


(U// 


(U/) 


U/FOES: 
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(U/FOHS 


5.6.3.4.10.2 (U//FOCO) EXAMPLES OF TYPE 5 ASSESSMENTS OPENED ON 
SPECIFIC NAMED POTENTIAL CHSS 


U/FOBO) 


(U/BO8O 


(U/ 
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(UFFOUOS If the Assessment is opened by an SA: The SA may open a Type 5 
Assessment with his/her SSA approval. If the recruitment is successful. the Type 5 
Assessment must be closed when the CHS is opened iq the recruitment is 
unsuccessful. the Type 5 Assessment must be closed. 


(U//BOUO) If the Assessment is opened by an IA: The IA must obtain the approval of 
his/her SIA and the supervisor of the relevant investigative or HUMINT i to a a 


Type 5 Assessment. (Note: An IA may not open an individual as a CHS i If 
the Assessment determines the person has placement and access to information or 
intelligence that would be of value, the Type 5 Assessment must be transferred to the 
appropriate investigative squad or the HUMINT squad to further evaluate and recruit the 
PCHS. 


5.6.3.5 (U) TYPE 6 ASSESSMENTS 


(U) Type 6 Assessment defined: Scck information, proactively or in response to 
investigative leads, relating to matters of foreign intelligence interest responsive to foreign 
intelligence requirements. 


(U/FOH) A Type 6 Assessment is designed to allow the FBI to determine whether the 
circumstances within a field office’s territory would enable the office to conduct a Full 
Investigation to collect information responsive to a Positive Foreign Intelligence (PFI) 
requirement. PFI requirements are described in DIOG Scction 9.1. A Type 6 Assessment 
focuses on a field office’s capability to collect on those PFI requirements. While no particular 
factual predication is required, the basis of the Assessment cannot be arbitrary or groundless 
speculation, nor can the Assessment be based solely on the exercise of First Amendment 
protected rights or on race, ethnicity. gender, national origin, religion. sexual orientation. or 
gender identity. or a combination of only those factors. 


(U//EQUO} Foreign Intelligence is “information relating to the capabilities, intentions, or 
activities of foreign governments or elements thereof, foreign organizations, or foreign 
persons.” The FBI defines a PFI requirement as a collection requirement issued by the USIC 
and is accepted by the FBI DI that seeks to collect information outside the FBI’s core national 
security mission. 

(U//FOUOSFBI employees must prioritize collection in response to FBI national collection 
requirements before attempting to collect against a positive forcign intelligence collection 
requirement. The IPG furnishes guidance on the prioritization of collection. 


(UFOO Sce Section 5.11 below for intelligence collection, {i.c., incidental collection) and 
documentation requirements. All incidental collection must be documented in the FBIHQ or 
field office 815] file. 


5.6.3.5.1 (U) DURATION 


(U//EOU6) There are no time limitations on the duration of a Type 6 Assessment. The 


effective date of the Assessment is the date on which the DI Lo ëO] 
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UC approves the EC. See DIOG section 5.6.2 above. 
A Type 6 Assessment may continue for as long as necessary to achieve its authorized purpose 
and clearly defined objective(s). Although a Type 6 Assessment is not limited in duration. 
when the authorized purpose and clearly defined objective(s) have been met. the Assessment 
must be closed or converted to a Full Investigation with an EC approved by the field office 
SSA or SIA and the FIMU UC. When closing a Type 6 Assessment that is designated as a 
SIM. the SAC and the DCHMS SC must approve the closing EC. 


5.6.3.5.2 (U) DOCUMENTATION 


Us A Type 6 Assessment must be opened by EC. using the appropriate 
The opening EC synopsis must identify the authorized purpose and the 
clearly defined objective(s) of the Assessment. The authorized purpose and clearly defined 
objective(s) should be described in more detail in the Details section of the EC. If additional 
objectives arise during the course of the Assessment, they must also be documented in an EC 
and approved by the field office SSA or SIA 


(U/EOBO Note: Investigative activity must not be conducted! out of 
5.6.3.5.3 (U) APPROVAL 


(U//FORO) All Type 6 Assessments must be opened by EC and approved in advance by an 
SSA or SIA and the appropriate DI UC. A Type 6 Assessment must be approved in 
accordance with the standards provided in DIOG Section 5.5. Notwithstanding any other 
provision in the DIOG. a Type 6 Assessment cannot be opened on oral approval. 


5.6.3.5.4 (U) SENSITIVE INVESTIGATIVE MATTERS (SIM) 


(U/FEUCOT If a Type 6 Assessment involves a sensitive investigative matter, the CDC/OGC 
must review and the SAC and the DI HOS/SC must approve the Assessment prior to opening. 
If a sensitive investigative matter arises after the opening of a Type 6 Assessment, 
Assessment activity may continue. but the matter must be reviewed by the CDC and approved 
by the SAC and the DI HOS/SC, as soon as practicable. but not more than five (5) business 
days after the sensitive investigative matter arises. The term “sensitive investigative matter” is 
defined in DIOG Section 5.7 and Section 10. 


5.6.3.5.5 (U) NOTICE 


(U/A-OUQ) FBIHQ authority, as specified above, is required to open a Type 6 Assessment; 
the opening EC will serve as notice to the DI. There is no requirement to provide notice to 
DOJ of opening or closing a Type 6 Assessment. 

5.6.3.5.6 (U) FILE REVIEW 


(U//FORO} A Type 6 Assessment requires a file review in accordance with DIOG Section 
3.4.4. 
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5.6.3.5.7 (U) RESPONSIBLE ENTITY 


(U#FOGO) A Type 6 Assessment may only be opened and conducted by the FIG and the DI 
(Refer to IPG for further details). Under the management of the FIG, field office investigative 
squads or FBIHQ divisions may support the collection of information in a Type 6 
Assessment. 


5.6.3.5.8 (U) TyPE 6 ASSESSMENT CLOSING 


(U//BOHO) See DIOG subsections 5.12.1 and 5.12.1.2 below for guidance on closing a Type 
6 Assessment. 


5.6.3.5.9 (U) EXAMPLES/SCENARIOS OF TYPE 6 ASSESSMENTS 
5.6.3.5.9.]} (U) EXAMPLE 1 
Us bIE 
/ 


5.6.3.5.9.2 (U) EXAMPLE 2 
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5.7 (U) SENSITIVE INVESTIGATIVE MATTERS (SIM) IN ASSESSMENTS AND 
SENSITIVE POTENTIAL CHS OR SENSITIVE CHARACTERISTIC 
DESIGNATIONS IN TyPE 5 ASSESSMENTS 


DIOG Secuon 10 contains the 


required approval authority and factors for consideration when determining whether to open or 
approve an Assessment involving a SIM. 


Sl (U) SIM CATEGORIES IN ASSESSMENTS 


(U//FOCC) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus, or any other matter which, in the judgment of the official 
authorizing an Assessment, should be brought to the attention of FBIHQ and other DOJ officials. 
{AGG-Dom, Part VIIN.) As a matt 
authorizing official is discretionary. 


5.7.2. (U) ACADEMIC NEXUS IN ASSESSMENTS 


(U//FBU6) As a matter of FBI policy, an investigative activity having an “academic nexus” is 
considered a SIM if: 


A) U/F6H8) 


(U//FO8O) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 
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5.8 (U) STANDARDS FOR OPENING OR APPROVING THE USE OF AN 
AUTHORIZED INVESTIGATIVE METHOD 
(U/¥O) Prior to opening or approving the use of an authorized investigative method, an FBI 
employce or approving official must determine whether: 


A) (U//B@O) The use of the particular investigative method is likely to further the authorized 
purpose and clearly defined objective(s) of the Assessment; 

B) (U/FOUO} The investigative method selected is the least intrusive method reasonable based 
upon the circumstances of the investigation; 

C) (U/ESY The anticipated value of the Assessment justifies the use of the selected 
investigative method or methods; 


D) (U//BOHO) If the purpose of the Assessment is to collect positive foreign intelligence, the 
investigative method complies with the AGG-Dom requirement that the FBI operate openly 
and consensually with an USPER. to the extent practicable; and 


E) (U//FO¥O) The investigative method is an appropriate usc of personnel and financial 
resources. 


5.9 (U) AUTHORIZED INVESTIGATIVE METHODS IN ASSESSMENTS 
5.9.1 (U) TYPE I THROUGH 4 AND TYPE 6 ASSESSMENTS 


(U/FOHO) A complete discussion of these investigative methods, including approval 
requirements, is contained in DIOG Section 18. The use or dissemination of information 
obtained by the use of the below-methods must comply with the AGG-Dom and DIOG Section 
14. Only the following investigative methods are authorized in Type 1 through 4 and Type 6 


A) {U) Public information. (Subsection 18.5.1) 
B) (U) Records or information - FBI and DOJ. (Subsection 


C) (U) Records 
(Subsection 


r information - Other federal, state, local, tribal, or foreign government agency. 
3) 

D) (U) On-line services and resources. (Subsection 
5) 


F) (U) Interview or request information from the public or private entities. (Subsection 38 


E) (U) CHS use and recruitment. (Section 


G) (U) Information voluntarily provided by governmental or private entities. (Subsection 
) 


1) (U) Grand jury subpoenas - to providers of electronic communication services (only available 
in a Type 1 & 2 Assessment). (Subsection ae 


H) (U) Physical Surveillance (not requiring a court order). (Subsection 


(UEOB Note: Consent Searches are authorized in Assessments. 
5.9.2 (U) TYPE 5 ASSESSMENTS 


(U//FEH@3 In addition to those investigative methods listed above in 5.9.1(A) — (H). Type 5 
Assessments only may also use the following investigative methods: 
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A) (U) Use of AFID or Cove uch only permitted for use during approved activity in a 
Type 5 Assessment. (See 


B) (U) Polygraph Examinations (See 


C) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 18.¢ 
Note: SSA approval and consultation with CDC/OGC required prior to use of this method). 


5.10 (U) OTHER INVESTIGATIVE METHODS Nor AUTHORIZED DURING 
ASSESSMENTS 

(U/ÆOH Additional investigative methods. which are authorized for Predicated 

Investigations, may not be used in Assessments. 


5.11 (U0) INTELLIGENCE COLLECTION (1.E., INCIDENTAL COLLECTION) 


(U//F686} Incidental collection is information derived durin, 
investigation, a sment. or al 
FBI. or IC collection requirement. 


the course of a pending 


(U/ROYO) Incidentally collected information. responsive to the above-mentioned collection 
requirements, may also be derived from 


(U/BOUO) 


U// 
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5.12. {U) RETENTION AND DISSEMINATION OF PRIVACY ACT RECORDS 


(U/FOUO) The Privacy Act restricts the maintenance of records relating to the exercise of First 
Amendment rights by individuals who are USPERs. Such records may be maintained if the 
information is pertinent to and within the scope of authorized law enforcement activities or for 
which there is otherwise statutory authority for the purposes of the Privacy Act (5 U.S.C. § 
522a[e][7]). Activities authorized by the AGG-Dom are authorized law enforcement activities. 
Thus. information concerning the exercise of First Amendment rights by USPERs may be 
retained if it is pertinent to or relevant to the FBI’s law enforcement or national security activity. 
Relevancy must be determined by the circumstances. If the information is not relevant to the law 
enforcement activity being conducted, then it may not be retained. For more information see 
DIOG Section 4.1. (AGG-Dom, Part I.C.5) 


(U) The Privacy Act. however, may not exempt from disclosure information gathered by the FBI 
during Positive Foreign Intelligence Assessments (Type 6 Assessments) and investigations of 
qualified U.S. citizens or lawfully admitted permanent residents if personally identifying 
information about such persons resides in those files. FB] employees should therefore be 
particularly vigilant about properly classifying any such information and should avoid 
unnecessary references to, and the documentation of. identifying information about U.S. citizens 
and lawfully admitted permanent residents in Positive Forcign Intelligence files. See DIOG 
Section 4.1.3. 


(UFO) Even if information obtained during an Assessment docs not warrant opening a 
Predicated Investigation, the FB] may retain personally identifying information for criminal and 
national security purposes. In this context. the information may eventually serve a variety of 
valid analytic purposes as pieces of the overall criminal or intelligence picture are developed to 
detect and disrupt criminal and terrorist activities. In addition, such information may assist FBI 
personnel in responding to questions that may subsequently arise as to the nature and extent of 
the Assessment and its results, whether positive or negative. Furthermore, retention of such 
information about an individual collected in the course of an Assessment will alert other 
divisions or ficld offices considering conducting an Assessment on the same individual that the 
particular individual is not a criminal or national security threat. As such, retaining personally 
identifying information collected in the course of an Assessment will also serve to conserve 
resources and prevent the initiation of unnecessary Assessments and other investigative 
activities. 


5.12.1 (U) MARKING TYPE 1 & 2, AND TYPE 3, 4 AND 6 CLOSED ASSESSMENTS 
THAT CONTAIN PERSONAL INFORMATION 


(U) Information obtained during an Assessment that has insufficient valuc to justify further 
investigative activity may contain personal information such as when records retained in an 
Assessment specifically identify an individual or group whose possible involvement in criminal 
or national sccurity-threatening activity was checked out through the Assessment. Therefore, 
whenever the Assessment turns up no sufficient basis to justify further investigation of the 
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individual or group, then the records must be annotated with the caveats listed in subsection 
5.12.1.1-3 below. 


(U) Extreme care should be taken when disseminating personally identifiable information 
collected during an Assessment that does not lead to sufficient facts to open a Predicated 
Investigation. If personal information from the Assessment is disseminated outside the FBI 
according to authorized dissemination guidelines and procedures. it must be accompanied by the 
required annotation that the Assessment involving this individual or group did not warrant 
further investigation by the FB] at the time the Assessment was closed. 


5:12.11 (U) TYPE 1 & 2 ASSESSMENTS 


b7E 


—— ee any FBI employee who shares information outside the 


FBI from such a closed Assessment file must ensure the following caveat is included in the 
dissemination: 
(U) “This person [or group] was identified during an Assessment but no information was 
developed at that time that warranted further investigation of the person [or group].” 
5.12.1:2 (U) TYPE 3, 4, AND 6 ASSESSMENTS 


UV/Æ99O 


orcover. any FBI employee who 
shares information outside the rom such a closed Assessment file must ensure the 
following caveat is included in the dissemination: 


(U) “This person [or group] was identified during an Assessment but no information was 
developed at that time that warranted further investigation of the person [or group].” 


5.12.1.3 (U) TYPE 5 ASSESSMENTS 


SS 


B) (U/FS89} All other Type 5 Assessments: 


i a ia a ae iar 


(U//EQU} Any dissemination from a closed Type 5 Assessment must be conducted in 
accordance with dissemination guidance on CHS closed files provided in th 


5.13. (U) ASSESSMENT FILE RECORDS MANAGEMENT AND RETENTION 


bIE 
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successor information technology system. must be retained according to NARA-approved 
disposition authorities. Consult the RMD Help Desk for assistance. 


ust be approved by the SSA or SIA If additional objectives arise 


during the Assessment. they must be documented in a , approved by the SSA or if 
appropriate, an oH Assessment classification files must be retained 
according to NARA-approved disposition authorities. 


5.13.1 (U) PENDING INACTIVE STATUS 
woa ————————— —  ] 
5.14 (U) OTHER PROGRAM SPECIFIC INVESTIGATION REQUIREMENTS 


(U/HFOHO) To facilitate compliance within an existing investigative program. the FBI employee 

should consult the relevant division’s PG. FBIHQ division PGs, however, may not contradict, 

alter or otherwise modify the standards established in the DIOG. This Page is Intentionally 
Blank 
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6 (U) PRELIMINARY INVESTIGATIONS 
6.1 (U) OVERVIEW 


(U) The AGG-Dom authorizes a second level of investigative activily—Predicated 
Investigations. Predicated Investigations that concern federal crimes or threats to the national 
security are subdivided into Preliminary Investigations (PI) and Full Investigations (Full). A 
Preliminary Investigation may be opened on the basis of any “allegation or information” 
indicative of possible criminal activity or threats to the national security. 


6.2 (U) PURPOSE AND SCOPE 


(U/FOUQ) A Preliminary Investigation may be opened to detect. obtain information about, or 
prevent or protect against federal crimes or threats to the national security. However. a 

Preliminary Investigation cannot be opened or used solely for the purpose of collecting against 
Positive Foreign Intelligence (PFI) requirements, or for conducting an Enterprise Investigation 


(EI). 


(U) The purposes for conducting Preliminary Investigation include such matters as: determining 
whether a federal crime has occurred or is occurring. or if planning or preparation for such a 
crime is taking place; identifying, locating, and apprehending the perpetrators; obtaining 
evidence needed for prosecution; or identifying threats to the national security. 


(U) The investigation of threats to the national security may constitute an exercise of the FBT s 
criminal investigation authority as well as its authority to investigate threats to the national 
security. As with criminal investigations, detecting and solving crimes and arresting and 
prosecuting the perpetrators are likely objectives of investigations relating to threats to the 
national security. These investigations, however. serve important purposes outside the ambit of 
normal criminal investigations, by providing the basis for decisions concerning other measures 
needed to protect the national security. 


6.3 (U) CivIL LIBERTIES AND PRIVACY 


(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to protect civil liberties in the conduct of criminal and national 
security investigations, every Preliminary Investigation under this subsection must have adequate 
predication that is documented in the opening communication. 


(U) No investigative activity. including Preliminary Investigations, may be taken solely on the 
basis of activitics that are protected by the First Amendment or on the race. cthnicity, gender. 
national origin, religion, sexual orientation, or gender identity of the subject. or a combination of 
only those factors. Preliminary Investigations of individuals, groups or organizations must focus 
on activities related to the threats and or crimes being investigated, not solely on First 
Amendment rights or on the race, ethnicity, gender. national origin. religion, sexual orientation, 
or gender identity of the subject. In this context. it is particularly important clearly to identify and 
document the law enforcement or national security basis of the Preliminary Investigation. 


(U) Example: Individuals or groups who communicate with cach other or with members of the 
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policy, protesting government actions. promoting certain religious beliefs, championing 
particular local. national. or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes—have a fundamental 
constitutional right to do so. A Preliminary Investigation may not be opened based solely on the 
exercise of these First Amendment rights. 


(U) The AGG-Dom present investigators with a number of authorized investigative methods in 
the conduct of a Preliminary Investigation. Considering the effect on the privacy and civil 
liberties of individuals and the potential to damage the reputation of individuals, some of these 
investigative methods are more intrusive than others. The least intrusive method if reasonable 
based upon the circumstances of the investigation is to be used. but the FBI must not hesitate to 
use any lawful method consistent with the AGG-Dom. A more intrusive method may be 
warranted in light of the seriousness of a criminal or national security threat. 


(U) By emphasizing the use of the least intrusive means to obtain intelligence, information, 
and/or evidence, FBI employees can effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
investigation, including targets, witnesses, and victims. This principle is not intended to 
discourage FBI employees from seeking relevant and necessary intelligence, information. or 
evidence. but rather is intended to encourage FB] employees to choose the least intrusive—but 
still reasonable based upon the circumstances of the investigation — means from the available 
options to obtain the intelligence, information or evidence. (See DIOG Subsection 4.4). 


6.4 (U) LEGAL AUTHORITY 
6.4.1 (U) CRIMINAL INVESTIGATIONS 


(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively to 
another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [a]) 


(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically. the FBI has jurisdiction to investigate felony killings of state 
law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers (28 U.S.C. 
§ 540A). and serial killers (28 U.S.C. § 540B). Authority to investigate these matters is 
contingent on receiving a request by an appropriate state official. 


6.4.2 (U) THREATS TO THE NATIONAL SECURITY 


(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders, Attorney General authorities, and various statulory sources. (See Appendix B: Execulive 
Order (EO) 12333; 50 U.S.C. §§ 3001 et seq.; 50 U.S.C. §§ 1801 et seq.) 


(U) “Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage. and assassination. conducted by, for. or on 
behalf of foreign powers. organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General. consistent with EO 12333 or any successor order. 
(AGG-Dom. Part VII.S) 


6-2 


UNCLASSIFIED -FOR OFFICIAL USE ONEYT Version Dated: 
March 3, 2016 


UNCLASSIFIED -FOR OFFICIAL CSE ONES 
Domestic Investigations and Operations Guide 86 


6.5 (U) PREDICATION 


(U) A Preliminary Investigation may be opened on the basis of “information or an allegation” 
indicating the existence of a circumstance described as follows: 

A) (U) An activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the investigation may obtain 
information or intelligence relating to the activity or the involvement or role of an individual, 
group, or organization in such activity. (AGG-Dom, Part II.B.3) 

B) (U) An individual, group, organization. entity, information, property, or activity is or may be a 
target of attack, victimization. acquisition, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information or intelligence that would help to protect against such 
activity or threat. (AGG-Dom, Part IL.B.3) 


(U//FORO) Examples: The following cxamples have sufficient predication to open a Preliminary 
Investigation: 


A) (U//FOtO) A CHS, with no established history, alleges that an individual is a member of a 
terrorist group: this “allegation” is sufficient predication to open a Preliminary Investigation: 
and 


B) (U//F@?S) If an analyst, while conducting an assessment, discovers on a blog a threat to a 
specific person, this “information” is enough to open a Preliminary Investigation. 


(U) NOTE: See DIOG Appendix G - Classified Provisions for additional circumstances 

warranting a Preliminary Investigation. 

6.6 | (U) STANDARDS FOR OPENING OR APPROVING A PRELIMINARY 
INVESTIGATION 


(U) Before opening or approving the conduct of a Preliminary Investigation. an FBI employee or 
approving official must determine whether: 

A) (UFOO) Adequate predication cxist for opening a Preliminary Investigation; 

B) (U//F@WO) The Preliminary Investigation is not based solely on the exercise of First 
Amendment rights or on the race, ethnicity, gender, national origin, religion, sexual 
orientation, or gender identity of the subject or a combination of only such factors; and 

C) (U/FFOMO) The Preliminary Investigation is an appropriate use of personnel and financial 
resources. 

(U//FOGO) Additional policies regarding Preliminary Investigations involving any forcign 
ambassador, foreign official, foreign student or exchange visitor, protected persons or premises 
as subjects may be found in to DIOG Appendix G — Classified Provisions [No Foreign Policy 
Objection]. 


(U/EOUO A Preliminary Investigation cannot be opened based solely on an FBI collection 
requirement. 
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6.7 (U) OPENING DOCUMENTATION, APPROVAL, EFFECTIVE DATE, NOTICE, 
EXTENSION, PENDING INACTIVE STATUS, CONVERSION, AND FILE 
REVIEW 


6.7.1 (U) OPENING DOCUMENTATION 


(U//FQ@UQ) The predication to open a Preliminary Investigation must be documented in the 
opening Electronic Communication (EC). In addition to the opening EC. division PGs may 
require the use of other specific forms to supplement the opening EC, i.e. FD-920. ete. The 
appropriate approving authority may grant oral authority to open a Preliminary Investigation if 
the standards for opening or approving a Preliminary Investigation are met. Should oral 
authorization to conduct a Preliminary Investigation be granted, an EC setting forth the 
predicating facts. as well as the identity of the authorizing supervisor and date of oral 
authorization. must be documented to the supervisor who granted the oral authorization, as soon 
as practicable, but not more than five (5) business days after granting oral authorization. 


(U/FOYO 


(U//FOUO) Note: Investigative activity must not be conducted"! out A ] b7E 
6.7.1.1 (U) APPROVAL / EFFECTIVE DATE / NOTICE 


(U//FERO) The effective date of the Preliminary Investigation is the date the final approval 
authority (e.g.. Supervisory Special Agent (SSA) or Special Agent-in-Charge (SAC)) 


If the Preliminary Investigation is opened on oral authority. the 
date on which the oral authority was granted is the effective date. See DIOG subsection 
3.4.2.2. Adding another subject after opening the Preliminary Investigation does not change 
the original effective date or the extension date. 


A) (U//FOUS) Opened By a Field Office: The opening of a Preliminary Investigation by the 
field office requires prior approval of the SSA 


B) (U//FOU0) Opened By FBIHQ: The opening of a Preliminary Investigation by FBIHQ 
requires prior approval of the Unit Chief (UC) 


C) (U//F@8O) Sensitive Investigatiye Matters (SIM): The opening of a Preliminary 


Investigation involving a SIM: 


| 
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1) (U/FOUS) SIM Opened by a Field Office: requires prior Chief Division Counsel (CDC) 
review and SAC approval. and written notification (EC). to the appropriate FBIHQ 
operational_unit with program responsibility within 15 calendar days following the 


b7E 


Additionally, the ficld office must notify the United 
in writing (bv LHM or similar documentation), as soon 
lafter the investigation is opened. (See 
for details concerning notice in 


tates Attorneys 
as practicable. 


countcrintelligence and espionage investigations.) 


umow o OOO 
a E 
operational unit with program responsibility. Upon receiving this notice, the FBIHQ 


operational unit must notify DOJ in writing (by LHM or similar documentation), as soon as 
practicable. after the investigation is opened. 


usse eee) 


(U/FOWO) If a SIM arises after the opening of a Preliminary Investigation, investigative 
activity may continue, but the matter must be reviewed by the CDC and approved by the 
SAC as soon as practicable, but not more than five (5) business days thereafter to continue 
the investigation. Written notice must be furnished to the appropriate FBIHQ operational 
unit with program responsibility and to the appropriate USAO or DOJ component as 
specified in the preceding paragraph. 


b7E 


2) (U/FOYQ) SIM Opened by FBIHQ: requires prior OGC review and SC approval, and 
we itten notification (EC) to the appropriate field office(s) within 15 calendar days 


itionally, the appropriate 
S or the appropriate DOJ official, in writing (by 
LHM or similar documentation). as soon as practicable, but no later than 30 calendar days 


FBIH s section does not provide notice to the applicable USAO. the FBIHQ section must 
g J. Sed 


(U//EOUO) If a SIM arises after the opening of a Preliminary Investigation, investigative 
activity may continue, but the matter must be reviewed by the OGC and approved by the 
appropriate FBIHQ operational SC as soon as practicable, but not more than five (5) 
business days thereafter to continue the investigation. Written notice must be furnished to 
the relevant field office(s) and to the appropriate USAO or DOJ component as specified in 
the preceding paragraph. 


D) (U/FOUQ) FBIHQ Disapproves Opening: The Exccutive Assistant Director (EAD) for the 
National Security Branch must notify the Deputy Attorney General if FBIHQ disapproves a 
field office’s opening of a Preliminary Investigation relating to a threat to the national security 
on the ground that the predication for the investigation is insufficient. and the EAD for the 
National Security Branch is responsible for establishing a system that will allow for the 
prompt retrieval of such denials. (AGG-Dom, Part II.B.S.d) 


6-5 


UNCLASSIFIED - POR OPFFHCEHMHEUSEONLY Version Dated: 
March 3, 2016 


UNCLASSIFIED -FOR OFFICIAL USE GRE 
Domestic Investigations and Operations Guide 86 


6.7.2 (U) EXTENSION 


(U7FEUQ}A Preliminary Investigation must be concluded within six months of its opening but 
may be extended for up to six months by the SAC (delegable to the ASAC)”. FBIHQ division 
PGs may require written notification of this six month extension to the appropriate FBIHQ 
operational unit and section. Extensions of Preliminary Investigations beyond a year are 
discouraged and may only be approved by the appropriate FBIHQ operational Section Chief for 
“good cause.” (AGG-Dom, Part II.B.4.a.ii) 


6.7.2.1 (U) GOOD CAUSE 


(UFFOYQ) The following factors must be used to determine whether “good cause” exists to 
extend the Preliminary Investigation beyond one year: 


A) (U/FOVOQ3 Whether logical investigative steps have yielded information that tends to 
inculpate or exculpate the subject; 


B) (U//AF@WO) The progress that has been made toward determining whether a Full Investigation 
should be opened or the Preliminary Investigation should be closed; 


C) (U//PEWO) Whether, based on the planned course of investigation for the following six 
months, it is reasonably likely that information will be obtained that will lead to predication 
for a Full Investigation, thereby warranting an extension for another six months, or will lead to 
exculpatory information, thereby warranting closing the Preliminary Investigation; and 


D) (U//FORO) Whether adequate predication has been developed to justify opening a Full 
Investigation or whether sufficient information has been developed that justifies closing the 
Preliminary Investigation. 


6.7.3. (U) PENDING INACTIVE STATUS 


6.7.4 (U) CONVERSION TO FULL INVESTIGATION 


(U//FOO) When converting a Preliminary Investigation to a Full Investigation. see DIOG 
Section 7 for approval and notification requirements. 


6.7.5 (U) FILE REVIEW 


(U//FOUQ) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with DIOG Section 3.4.4. File reviews for probationary FBI employees must be 
conducted at least every 60 days. 


6.8 (U) STANDARDS FOR OPENING OR APPROVING THE USE OF AN 
AUTHORIZED INVESTIGATIVE METHOD IN PRELIMINARY 
INVESTIGATIONS 


(U/FOHO Prior to opening or approving the use of an investigative method. an FB] employee 
or approving official must determine whether: 


12 (U/ / FOR) SAC approval required to extend Preliminary Investigations was non-delegable in the previous 
version of the DIOG. That restriction has been removed in this version. 
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A) (U//F6¥8) The use of the particular investigative method is likely to further the authorized 
purpose of the Preliminary Investigation; 
B) (U//F@8Q) The investigative method selected is the least intrusive method, if reasonable 
based upon the circumstances of the investigation; and 
C) (U/FOUS) The method to be used is an appropriate use of personnel and financial resources. 


6.9 (U) AUTHORIZED INVESTIGATIVE METHODS IN PRELIMINARY 
INVESTIGATIONS 
(U) All lawful methods may be used in a Preliminary Investigation, except for mail opening. 
physical search requiring a Federal Rules of Criminal Procedure (FCRP) Rule 41 search warrant 
or a Foreign Intelligence Surveillance Act (FISA) order. clectronic surveillance requiring a 
judicial order or warrant (Title II] or FISA), or Title VII FISA requests. Authorized methods 
include, but are not limited to. those listed below. Some of the methods listed are subject to 
special restrictions or review or approval requirements. (AGG-Dom, Part V.4.A) 


(U//FEU8) A complete discussion of these investigative methods. including approval 
requirements, is contained in Section 18. The use or dissemination of information obtained by 
the use of the below methods must comply with the AGG-Dom and DIOG Section 14. The 
following investigative methods are authorized to be used in Preliminary Investigations: 

A) (U) Public information. (See subsection 


B) (U) Records or information - FBI and DOJ. (See subsection | 


C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See subsection 18.5 


D) (U) On-line services and resources. (See subsection 18.3.4 


E) (U) CHS use and recruitment. (See subsection ) 


F) (U) Interview or request information from the public or private entities. (See subsection 
18.5.6) 


G) (U) Information voluntarily provided by governmental or private entities. (See subsection 


IRET 


H) (U) Physical Surveillance (not requiring a court order}. (See subsection 4 


1) (U) Consensual monitoring of communications, including electronic communications. (See 
subsection 18.6.1) 
(U//FERHBS Sce the classified provisions in Appendix G for additional information. 
J) (U) Intercepting the communications of a computer trespasser. (See subsection 18.6.2 ) 
K) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (Sec subsection 18.5.3) 
L) (U) Administrative subpoenas. (See subsection 18.6.4 


M)(U) Grand jury subpoenas. (See subsection 18.6.5) 


N) (U) National Security Letters. (See subsection 18 


O) (U) FISA Order for business records. (See subsection 


67 


UNCLASSIFIED - FOR UFFICIAL USE ONEY Version Dated: 
March 3, 2016 


UNCLASSIFIED - FOR OFFICIAL CSE-ONEY 
Domestic Investigations and Operations Guide 86 


P) (U) Stored wire and electronic communications and transactional records. (See subsection 
6.3)" 


Q) (U) Pen registers and trap/trace devices. (See subsection 18. 
R) (U) Mail covers. (See subsection 18.6.19) 


S) (U) Polygraph examinations. (See subsection {8.6.11 


T) (U) Trash Covers (Searches that do not require a warrant or court order). (See subsection 


») 


U) (U) Undercover operations. (See subsection {8.6.1 


(U) See ROG. 


for additional information. 


6.10 (U) SENSITIVE INVESTIGATIVE MATTERS (SIM) IN PRELIMINARY 
INVESTIGATIONS 


(U/FOHO}| 
DIOG Section 10 


contains the required approval authority and factors for consideration when determining whether 
to conduct or approve a Preliminary Investigation involving a SIM. 


6.10.1. (U) SIM CATEGORIES IN PRELIMINARY INVESTIGATIONS 


(U/TFO¢@) A SIM is an investigative matter involving the activitics of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus. or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBIHQ and other DOJ 
officials. (AGG-Dom, Part VII.N.) As a matter of F] icy, “judg H 

decision of the authorizing official is discretionary. 


6.10.2 (U) ACADEMIC NEXUS IN PRELIMINARY INVESTIGATIONS 


U/FOUO 


A) (UI 


B) (U/FE88) 


3 (U/ /PORO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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(U//FOUQ)The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (e.g., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however. that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 


ure OOO UUN 
6.11 (U) INTELLIGENCE COLLECTION (1.E., INCIDENTAL COLLECTION) 


(U//FOUQ) Incidental collection is information derived during the course of a pending 
investigation, assessment, or al that is responsive to a PFI, FBI, or IC collection 
requirement, 


(U//FORO} Incidentally collected information. responsive to the above-mentioned collection. 
requirements, may also be derived from 


U/FOYO 


(U/POUQ) 
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6.12 {U) STANDARDS FOR APPROVING THE CLOSING OF A PRELIMINARY 
INVESTIGATION 
6.12.1 (U) STANDARDS 

(U//FEBQ) At the conclusion of a Preliminary Investigation, each of the following items must 
be documented in the closing communication (EC and/or LHM): 

A) (U/F O66) A summary of the results of the investigation; 

B) (U/EOHO) Whether all logical and reasonable investigation was completed; 


C) (UFOO) Whether all investigative methods/techniques initiated have been completed 
and/or discontinued; 


D) (U/FOY®) Whether all leads set have been completed and/or discontinucd; 


E) (U/FOY9} Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy; and 


F) (U//FOUG) A summary statement of the basis on which the Preliminary Investigation will be 
closed, and a selection of the appropriate closing status: 


D (U/FEHO) C-4: Administrative Closing, which includes: 


a) (U//FOUG) No further investigation is warranted because logical investigation and/or 
leads have been exhausted, and the investigation to date did not identify a criminal 
violation or a priority threat to the national security 


b) (U//PORQ) Investigation assigned a new file number 


c) (U/PFOUS) Investigation consolidated into a new file number or an existing file 
number, or 


d) (U//FOUO}Unaddressed Work investigation file closed because no investigation or no 
further investigation will be conducted 


2) (U//FO#O) C-5: USA Declination Closing, which includes: 
a) (U//FOUO) The USAO declined prosecution - individual matter declination 
b) (U//FOUO) The USAO declined prosecution — blanket declination 
3) (U//FOUS} C-6: Other Closing, which includes: 
a) (U//FOYQ) National security investigation has been completed 
b) (UAFEH6) Prosecution became non-viable for national security reasons 


c) (U#FOUQ) Any other reason to close 
6.12.2 (U) APPROVAL REQUIREMENTS TO CLOSE 


(U//F@RO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in subsection 6.12.1) to ensure it contains the above 
required information and sufficient details of the investigation on which to base the decision to 
close the Preliminary Investigation. The appropriate closing supervisors are: 


A) (U//F@80) Opened by a Field Office: Closing a Preliminary Investigation opened by a field 
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fotitication to the ‘Operational unit May be required by division PGs. 


B) (U/FFEYQ) Opened by FBIHQ: Closing a Preliminary Investigation opened by FBIHQ 
requires approval from the UC and notification to any appropriate field office. 

C) (U/FOW9) SIM Opened by a Field Office: Closing a Preliminary Investigation opened by a 
field office involving a SIM requires approval from the SAC, written notification to the 
FBIHQ operational unit and section. 

D) (U//F@06) SIM Opened by FBIHQ: Closing a Preliminary Investigation opened by FBIHQ 
involving a SIM requires approval from the SC and written notification to any appropriate 
field office. 


(U) OTHER PROGRAM-SPECIFIC INVESTIGATIVE REQUIREMENTS 


(U//PEYO}To facilitate compliance with investigative program specific requirements, the FBI 
employce should consult the relevant division’s PG. No policy or PG may contradict, alter or 
otherwise modify the standards of the DIOG. A DIOG related policy or PG must adhere to the 
standards, requirements and procedures established by the DIOG. Requests for DIOG 
modifications can be made to the Internal Policy Office (IPO) pursuant to DIOG subsection 3.2.2 
paragraphs (A), (B), (C) and (D). 
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7 (U) FULL INVESTIGATIONS ALL INFORMATION CONTAIMED 


HEREIN IS UNCLASSIFIED 
DATE 05-09-2018 BY NSICG b6 
7A (U) OVERVIEW b7c 


(U//FOUQ) The AGG-Dom authorizes a second level of investigative activity—Predicated 
Investigations. Predicated Investigations that concern federal crimes or threats to the national 
security are subdivided into Preliminary Investigations (P1) and Full Investigations (Full). A Full 
Investigation may be opened if there is an “articulable factual basis” of possible criminal or 
national threat activity, as discussed in greater detail in Section 7.5, below. There are three types 
of Full Investigations: (i) single and multi-subject; (ii) Enterprise; and (iii) positive foreign 
intelligence collection. 


T2 {U} PURPOSE AND SCOPE 

(U) A Full Investigation may be opened to detect, obtain information about, or prevent or protect 
against federal crimes or threats to the national security or to collect foreign intelligence. 

(U) The purposes for conducting Full Investigations include such matters as: 


A) (U) determining whether a federal crime is being planned, prepared for, occurring or has 
occurred; 

B) (U) identifying. locating, and apprehending the perpetrators; 

C) (U) obtaining evidence for prosecution; 

D) (U) identifying threats to the national security; 

E) (U) investigating an enterprise (as defined in DIOG Section 8); or 

F) (U) collecting positive foreign intelligence (PFI) (as defined in DIOG Section 9). 
(U) The investigation of threats to the national security can be investigated under the FBI’s 
criminal investigation authority or its authority to investigate threats to the national security. As 
with criminal investigations, detecting and solving crimes, gathering evidence and arresting and 
prosecuting the perpetrators are frequently the objectives of investigations relating to threats to 
the national security. These investigations also serve important purposes outside the ambit of 
normal criminal investigations. however, by providing the basis for decisions concerning other 
measures needed to protect the national security. 


(U//FERQ) A Full Investigation solely for the collection of positive foreign intelligence extends 
the sphere of the FBI’s information gathering activities beyond federal crimes and threats to the 
national security and permits the FBI to seck information regarding a broader range of matters 
relating to foreign powers. organizations. or persons that may be of interest to the conduct of the 
United States’ foreign affairs. (See DIOG Section 9) 


73 {U} CIVIL LIBERTIES AND PRIVACY 


(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FB] meets through the application of sound 
judgment and discretion. In order to protect civil liberties during the conduct of criminal and 
national security investigations, every Full Investigation under this subsection must have 
adequate predication that is documented in the opening communication. 
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(U) No investigative activity. including Full Investigations, may be taken solely on the basis of 
rights that are protected by the First Amendment or on the race. ethnicity, gender, national 
origin, religion. sexual orientation. or gender identity of the subject. or a combination of only 
those factors. Full Investigations of individuals, groups or organizations must focus on activities 
related to the threats or crimes being investigated, not solely on First Amendment rights or on the 
race, ethnicily, gender, national origin, religion, sexual orientation, or gender identity of the 
subject. In this context, it is particularly important clearly to identify and document the law 
enforcement or national security basis of the Full Investigation. 


(U) Example: Individuals or groups who communicate with cach other or with members of the 
public in any form in pursuit of social or political causes—such as opposing war or foreign 
policy, protesting government actions. promoting certain religious beliefs, championing 
particular local. national. or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes—have a fundamental 
constitutional right to do so. A Full Investigation may not be opened based solely on the exercise 
of these First Amendment rights. 


(U) The AGG-Dom authorizes all lawful investigative methods in the conduct of a Full 
Investigation. Considering the effect on the privacy and civil liberties of individuals and the 
potential to damage the reputation of individuals, some of these investigative methods are more 
intrusive than others. The least intrusive method if reasonable based upon the circumstances of 
the investigation is to be used, but the FBI must not hesitate to use any lawful method consistent 
with the AGG-Dom. A more intrusive method may be warranted in light of the seriousness of a 
criminal or national security threat or the importance of a foreign intelligence requirement. 


(U) By emphasizing the use of the least intrusive means to obtain intelligence or evidence, FBI 
employees can effectively execute their duties while mitigating the potential negative impact on 
the privacy and civil liberties of all people encompassed within the investigation. including 
targets, witnesses, and victims. This principle is not intended to discourage FBI employees from 
secking relevant and necessary intelligence. information, or evidence, but rather is intended to 
encourage FBI employees to choose the least intrusive—but still reasonable based upon the 
circumstances of the investigation—from the available options to obtain the intelligence, 
information or evidence. (See DIOG Section 4) 


74 (U) LEGAL AUTHORITY 


7.4.1 (U) CRIMINAL INVESTIGATIONS 


(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively to 
another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [a].) 


(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically. the FBI has jurisdiction to investigate felony killings of state 
law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers (28 U.S.C. 
§ 540A). and serial killers (28 U.S.C. § 540B). Authority to investigate these matters is 
contingent on receiving a request by an appropriate state official. 
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7.4.2 (U) THREATS TO THE NATIONAL SECURITY 


(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders. Attorney General authorities, and various statutory sources. (See E.O. 12333; 50 U.S.C. 
§§ 3001 ct seq.; 50 U.S.C. §§ 1801 ct seq.) 


(U) “Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage. and assassination. conducted by. for, or on 
behalf of foreign powers. organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General. consistent with Executive Order 12333 or any 
successor order. (AGG-Dom. Part VII.S) 


7.4.3 (U) FOREIGN INTELLIGENCE COLLECTION 


(U) The FBI authority to collect foreign intelligence derives from a mixture of administrative and 
statutory sources. (See E.O. 12333; 50 U.S.C. §§ 3001 et seq.; 50 U.S.C. §§ 1801 et seq.; 28 
USE 2 note (incorporates the Intelligence Reform and Terrorism Protection Act. P.L. 108- 
458 §§ 2001-2003). 


(U) “Foreign Intelligence” is defined as information relating to the capabilities, intentions, or 
activities of foreign governments or clements thereof. foreign organizations or forcign persons, 
or international terrorists. (AGG-Dom, Part VILE) 


75 (U) PREDICATION 


(U) A Full Investigation may be opened if there is an “articulable factual basis” that reasonably 
indicates one of the following circumstances exists: 


A) (U) An activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur and the investigation may obtain 
information relating to the activity or the involvement or role of an individual, group, or 
organization in such activity; 

B) (U) An individual, group, organization, entity, information, property. or activity is or may be a 
target of attack, victimization, acq n, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information that would help to protect against such activity or threat; 
or 


C) (U) The investigation may obtain forcign intelligence that is responsive to a PFI requirement, 
as defined in DIOG Section 7.4.3, above. 


(U/FORQ) Examples: The following examples have sufficient predication to open a Full 
Investigation: 


A) (U/FOHQ) corroborated information from an intelligence agency states that an individual is a 
member of a terrorist group, 


B) (U//FO8) an analyst discovers on a blog a threat to a specific home builder and additional 
information connecting the blogger to a known terrorist group; and 


C) (U//FOU@}FBI DI has posted an authorized PFI requirement for collection. 


(U) NOTE: See High 
Investigation. 


zs for additional circumstances warranting a Full 
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76 (U) STANDARDS FOR OPENING OR APPROVING A FULL INVESTIGATION 
(U//FOUO) Before opening or approving the conduct of a Full Investigation, an FBI employee or 
approving official must determine whether: 

A) (U//PORO) Adequate predication exist for opening a Full Investigation; 


B) (U//FO®) The Full Investigation is not based solely on the exercise of First Amendment 
rights or on the race, ethnicity. gender, national origin. religion, sexual orientation, or gender 
identity of the subject or a combination of only such factors; and 

C) (U/FORS) The Full Investigation is an appropriate use of personnel and financial resources. 

(U/FOBO) Additional policies regarding Full Investigations involving any forcign ambassador, 
foreign official, foreign student or exchange visitor. protected persons or premises as subjects 
may be found in DIOG Appendix G — Classified Provisions (No Foreign Policy Objection 
[NFPO]). 


(U/FOĐO>}A Full Investigation cannot be opened solely based on an FBI collection 
requirement. 


V7 (U) OPENING DOCUMENTATION, APPROVAL, EFFECTIVE DATE, NOTICE, 
PENDING INACTIVE STATUS, FILE REVIEW, AND LETTER HEAD 
MEMORANDUM 


Tal (U) OPENING DOCUMENTATION 


(U/HFOEO) The predication to open a Full Investigation must be documented in the opening EC. 
In addition to the opening EC, division PGs may require the use of other specific forms to 
supplement the opening EC. i.c. FD-920. ctc. The appropriate approving authority may grant oral 
authority to open a Full Investigation if the standards for opening or approving a Full 
Investigation are met. Should oral authorization to conduct a Full Investigation be granted, an EC 
setting forth the predicating facts, as well as the identity of the authorizing supervisor and date of 
oral authorization, must be documented to the supervisor who granted the oral authorization, as 
soon as practicable. but not more than five (5) business days after granting the authorization. 


(UFFORO) 


(U//FOHO) Note: Investigative activity must not be conducted" out fd 
Eiki (U) APPROVAL / EFFECTIVE DATE / NOTICE 


(UFB The effective date of the Full Investigation is the date the final a 
(e.g.. SSA or SAC) approves the EC 


roval authority 


investigation is opened on oral 
authority. the date on which the oral authority was granted is the date the investigation was 
opened. See subsection 3.4.2.2. 


| 
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A) (U//POUS) Opened By a Field Office: The opening of a Full Investigation for circumstances 
described in subsections 7.5.A and 7.5.B (i.e., for any reason other than to collect intelligence 
that is responsive to a PFI requirement) by a field office requires prior approval of the SSA 
with written notification within 15 calendar days of the opening to the responsible FBIHQ 
operational unit. The opening of a Full Investigation of a United States person (USPER) 
relating to a threat to the national security for circumstances described in Sections 7.5.A and 
7.5.B (i.e. for any reason other than to collect intelligence th: responsive to a PFI 
requirement) requires the responsible FBIHQ-NSB unit to notify DOJ NSD as soon as 
practicable, but in all events within 30 calendar days after the investigation is opened or the 
subject is determined to be an USPER. If the subject of the investigation is a non-USPER and 
later becomes or is determined to be an USPER, the notice provisions in this subsection to 
DOJ NSD also apply. 


B) (U/FOUG) Opened By FBIHQ: The opening of a Full Investigation by FBIHQ for 
circumstances described in Sections 7.5.A and 7.5.B (i.e. for any reason other than to collect 
intelligence that is responsive to a PFI requirement) requires prior approval of the UC with 
written notification within 15 calendar days of the opening to any appropriate field office. The 
opening of a Full Investigation by FBIHQ of an USPER relating to a threat to the national 
security for circumstances described in Sections 7.5.A and 7.5.B (i.c., for any reason other 
than to collect intelligence that is responsive to a PFI requirement) also requires notice to DOJ 
NSD as soon as practicable, but in all events within 30 days after the investigation is opened 
or the subject is determined to be an USPER. If the subject of the investigation is a non- 
USPER and later becomes or is determined to be an USPER, the notice provisions in this 
subsection to the field office and DOJ also apply. 


C) (U//FOUO) Sensitive Investigative Matters (SIM): The opening of a Full Investigation 
involving a sensitive investigative matter: 


1) (U/FƏY6) SIM Opened by a Field Office: requires prior Chief Division Counsel (CDC) 
review and SAC approval, and written notification ee > the aaah FBIHQ 
operational unit with program responsibility within 1 dar days following the 


dditionally, the ficld office must notify the United 
States Attorney's Office (USAO) in writing (by LHM or similar documentation), as soon 


as practicable, but no later than 30 calendar days after the investigation is opened. (See 
Fr deils oncoming notice în 
counterintelligence and espionage investigations.) 

(U/FO86) If the field office does not provide notice to the USAO. the field office must 


state the circumstances for not notifying the USAO in its written notice to the FBIHQ 
operational unit with program responsibility. Upon receiving this notice the FBIHQ 


operational unit must notify DOJ in writing (by LHM or similar documentation), Sí 
practicable, after the investigation is opened. See 


y for additional notice requirements. 


umo SS S S 


Written notice must be furnished to the appropriate FBIHQ operational unit 
with program responsibility and to the appropriate USAO or DOJ component as specified 


in the preceding paragraph. 
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2) (U/FOU6) SIM Opened By FBIHQ: requires prior OGC review and SC approval, and 


written notification (EC) to the appropriate field office(s} within 15 calendar days 


Additionally, the appropriate FBIH 
Section must notify the applicable USAO or the appropriate DOJ official, in writing (by 

LHM or similar documentation), as soon as prac ble, but no later than 30 calendar days 
after the investigation is opened. (See { i 


for details concerning notice in counterintelligence and espionage 
investigations.) If the 


FBIHQ section does not provide notice to the applicable USAO, the FBIHQ section must 
state beh in its written notice to the field office{s) and DOJ. See £ 
3 for additional notice requirements. 


G Apps 


ritten notice must be furnished to the relevant 


SAO or DOJ component as specified in the 


D) (U//FOOOY Positive Foreign Intelligence Full Investigation: The opening of a Full 
Investigation in order to collect positive foreign intelligence for circumstances described in 
Section 7.5.C above must be approved as provided in DIOG Section 9. Additionally, written 
notification to FBLHQ Domain, Collection, HUMINT Management Section (FIMS) SC and 
DOJ NSD is required as soon as practicable but no later than 30 calendar days after opening 
the investigation. 

E) (U//FO00) FBIHQ Disapproves Opening: The EAD for the National Security Branch (NSB) 
must notify the Deputy Attorney General if FBIHQ disapproves a ficld office's opening of a 
Full Investigation relating to a threat to the national security on the ground that the predication 
for the investigation is insufficient. and the EAD for the NSB is responsible for establishing a 
system that will allow for the prompt retrieval of such denials. (AGG-Dom, Part L.B.5.d) 


7.7.2 (U) PENDING INACTIVE STATUS 


(U//FOUS) A Full Investigation may be placed in “pending inactive” status once all logical 
investigation has been completed and only prosccutive action or other disposition remains to be 
reported. Examples of Full Investigations that may be placed in “pending inactive” status would 
include, but not be limited to: criminal investigations pending an appeal; fugitive investigations. 
when all logical investigation has been conducted and the subject is still in fugitive status; 
parental kidnapping investigations, when the parent who kidnapped the child is residing in a 
foreign country and the local authorities will not or cannot extradite the subject back to the 
United States. 


773 (U) FILE REVIEW 


(U/FOU0) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with DIOG Section 3.4.4. File reviews for probationary FBI employees must be 
conducted at least every 60 days. 
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TIA (U) ANNUAL LETTERHEAD MEMORANDUM 


(U//FOUQ) Annual letterhead memoranda regarding the status of Full Investigations are not 
required by the AGG-Dom; however. the FBIHQ operational divisions may require such reports 
in their PGs. Sce foreign intelligence collection in Section 9 for annual reporting requirements to 
FBIHQ FIMS and DOJ. 


7.8 {U} STANDARDS FOR OPENING OR APPROVING THE USE OF AN 
AUTHORIZED INVESTIGATIVE METHOD IN FULL INVESTIGATIONS 
(U/P@0} Prior to opening or approving the use of an investigative method, an FBI employee 

or approving official must determine whether: 


A) (U//FOUS) The use of the particular investigative method is likely to further the authorized 
purpose of the Full Investigation; 

B) (U//FOHO) The investigative method selected is the least intrusive method, if reasonable 
based upon the circumstances of the investigation; 

C) (U/FOVEO) If the Full Investigation is for collecting positive foreign intelligence, the FBI is 
operating openly and consensually with a USPER, to the extent practicable; and 

D) (U//FOUQ) The method to be used is an appropriate use of personnel and financial resources. 

79 (U) AUTHORIZED INVESTIGATIVE METHODS IN FULL INVESTIGATIONS 


(U) All lawful methods may be used in a Full Investigation, unless the investigation is to collect 
foreign intelligence. A complete discussion of these investigative methods, including approval 
requirements. is contained in Section 18. The use or dissemination of information obtained by 
the use of these methods must comply with the AGG-Dom and DIOG Section 14. The following 
investigative methods are authorized to be used in all Full Investigations, other than 
investigations to collect foreign intelligence: 


A) (U) Public information. (Subsection 
B) (U) Records or information - FBI and DOJ. (Subsectio 


C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(Subsection 3) 


D) (U) On-line services and resources. (Subsection | 


E) (U) CHS use and recruitment. (Subsection 38.5.5) 


F) (U) Interview or request information from the public or private entities. (Subsection 


G) (U) Information voluntarily provided by governmental or private entities. (Subsection {$ 

D 

al monitoring of communications, including electronic communications. 
1) 

(U/FOYO) See the classified provisions in Appendix G for additional information. 

) 


K) (U) Closed-cireuit television/video surveillance, direction finders, and other monitoring 
devices. (Subsection 6.3) 


H) (U) Physical Surveillance (not requiring a court order). (Subsection 


D) (U) Consens 
(Subsection 


J) (U) Intercepting the communications of a computer trespasser. (Subsection 
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L) (U) Administrative subpoenas. (Subsection a) 


M)(U) Grand jury subpoenas. (Subsection 


8) 
O) (U) FISA Order for business records. (Subsection 18.6.7). 


N) (U) National Security Letters. (Subsection 


P) (U) Stored wire and electronic communications and transactional records. (Subsectio! 


Q) (U) Pen registers and trap/trace devices. (Subsection 18.6.9) 
R) (U) Mail covers. (Subsection i 


S) (U) Polygraph examinations. (Subsection 48.6.14) 


T) (U) Trash Covers (Searches that do not require a warrant or court order). (Subsection } 


U) (U) Undercover Operations (Subsection i% 


V) (U) Searches — with a warrant or court order. (Subsection 18.7.4) 


) 
ISA and FISA Title VII (acquisition of foreign intelligence 


WXU) Electronic surveillance — Title III. (Subsection 1% 


X) (U) Electronic surveillance 
information). (Subsection 


(U) See £ 7 Appendi. ified Provisions for additional information. 


7.10 (U) SENSITIVE INVESTIGATIVE MATTERS (SIM) IN FULL INVESTIGATIONS 


(U/FORO) 
DIOG 


Section 10 contains the required approval authority and factors to be considered when 
determining whether to conduct or approve a Full Investigation involving a SIM. 


7.10.1 (U) SIM CATEGORIES IN FULL INVESTIGATIONS 


(U//FOUO) A SIM is an investigative matter involving the activities of a domestic public official 
or domestic political candidate (involving corruption or a threat to the national security), 
religious or domestic political organization or individual prominent in such an organization, or 
news media, an academic nexus. or any other matter which, in the judgment of the official 
authorizing an investigation. should be brought to the attention of FBIHQ and other DOJ 
officials. (AGG-Dom, Part VII.N). As a matter of FBI policy, “judgment” means that the 
decision of the authorizing official is discretionary. DIOG Section 10 and/or the DIOG Appendix 
G — Classified Provisions defin: 


7.10.2 (U) ACADEMIC NEXUS IN FULL INVESTIGATIONS 


a 


A) U/FB 88) 
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B) (U/ 


(U/AFOBSO) The sensitivity related to an academic institution arises from the American tradition 
of “academic freedom” (i.e., an atmosphere in which students and faculty are free to express 
unorthodox ideas and views and to challenge conventional thought without fear of repercussion). 
Academic freedom does not mean, however, that academic institutions are off limits to FBI 
investigators in pursuit of information or individuals of legitimate investigative interest. 


7A1 (U) INTELLIGENCE COLLECTION (1.E., INCIDENTAL COLLECTION) 


(U//F688) Incidental collection is information derived during the course of a pending 
investigation, Assessment, orf hat is responsive to a PFI, FBI, or IC collection 


i uirement 


(U//FOO) Incidentally collected information, responsive to the above-mentioned collection 
requirements, may also be derived fror 


(U/FORO 


(See DIOG Subsection 


(Uli 
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(U) Because the authority to collect positive foreign intelligence enables the FB] to obtain 
information pertinent to the United States’ conduct of its foreign affairs, even if that information 
is not related to criminal activity or threats to the national security. the information gathered may 
concern lawful activities. Accordingly, the FBI must operate openly and consensually with an 
USPER to the extent practicable when collecting positive foreign intelligence that does not 
concern criminal activities or threats to the national security. 
7.12 (U)STANDARDS FOR APPROVING THE CLOSING OF A FULL 
INVESTIGATION 
7.12.1 (U) STANDARDS 
(U//FEO) At the conclusion of a Full Investigation. cach of the following items must be 
documented in the closing communication (EC and/or LHM): 
A) (U/FOUQ) A summary of the results of the investigation; 


B) (U//FOWO) Whether sufficient personnel and financial resources were expended on the 
investigation, or an explanation/justification for not expending sufficient resources; 


C) (U//FOUO) Whether logical and reasonable investigation was completed; 


D) (U//FEHO) Whether all investigative methods/techniques initiated have been completed 
and/or discontinued; 


E) (U//FQHO) Whether all leads set have been completed and/or discontinued; 


F) (U//F@¥88) Whether all evidence has been returned, destroyed or retained in accordance with 
evidence policy; and 


G) (U/FOHO) A summary statement of the reason the Full Investigation will be closed, and 
selection of the appropriate closing status: 


1) (U/FOHS) C-4: Administrative Closing, which includes: 


a) (UVEOYO) No further investigation is warranted because logical investigation and/or 
leads have been exhausted, and the investigation to date did not identify a criminal 
violation or a priority threat to the national security 


b) (U//FO¥Q) Investigation assigned a new file number 
c) (UFS Investigation consolidated into a new file number or an existing file number 


d) (U//FOUG} Unaddressed Work investigation file closed because no investigation or no 
further investigation will be conducted 


2) (U/FORQ) C-5: USA Declination Closing, which includes: 
a) (U//P@8@) The USAO declined prosecution — individual matter declination 
b) (U//FORO) The USAO declined prosecution — blanket declination 

3) (U/FOHO) C-6: Other Closing, which includes: 


a) (U//FOUD) Final prosecution or final prosecutive action has been completed 
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b) (U//F@86) National security investigation has been completed 
c) (U/FOUS) Prosecution became non-viable for national security reasons 
d) (U/FEHO) A federal grand jury returned a “No Truc Bill” 
c) (U//FOHQ) A nolle prosequi has been entered with the court 
Ð (UVEQUO any other reason for closing 
7.12.2 (U) APPROVAL REQUIREMENTS TO CLOSE 


(U/TFOUO) The appropriate closing supervisor described below must review and approve the 
closing communication (as described in Section 7.12.1) to ensure it contains the above-required 
information and sufficient details of the investigation on which to base the decision to close the 
Full Investigation. Although there is no duration limit for a Full Investigation, the investigation 
must be closed upon all investigative activity being exhausted. The appropriate closing 
supervisors are: 

A) (UPFORO) Opened by a Field Office: Closing a Full Investigation opened by a field office 
requires approval from the SSA. Closing a Full Investigation involving espionage or an 
espionage related matter, requires the concurrence of the FBIHQ Counterespionage section 
chief. Notification to the FBIHQ operational unit may be required by division PGs. 

B) (U//FO8@) Opened by FBIHQ: Closing a Full Investigation opened by FBIHQ requires 
approval from the UC and notification to the appropriate ficld office. 

C) (U/FOUG) SIM Opened by a Field Office: Closing a Full Investigation opencd by a ficld 
office involving a SIM requires approval from the SAC, written notification to the FBIHQ 
operational unit and section. 

D) (U//FOUS) SIM Opened by FBIHQ: Closing a Full Investigation opened by FBIHQ 
involving a sensitive investigative matter requires approval from the SC and written 
notification to the appropriate field office. 


E) (U/FOUS) Positive Foreign Intelligence: (See DIOG Scction 9) 
7.13 (U) OTHER PROGRAM SPECIFIC INVESTIGATIVE REQUIREMENTS 


(U//FOHO) To facilitate compliance with investigative program-specific requirements, the FBI 
employce should consult the relevant division’s PG to ascertain any program-specific 
requirements. No policy or PG may contradict, alter or otherwise modify the standards of the 
DIOG. DIOG related policy or PGs must adhere to the standards, requirements and procedures 
established by the DIOG. Requests for DIOG modifications can be made to the Internal Policy 
Office (IPO) pursuant to DIOG Section 3.2.2 paragraphs (A), (B), (C) and (D). 
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18 (U) INVESTIGATIVE METHODS 
18.1 (U) OVERVIEW 


18.1.1 (U) INVESTIGATIVE METHODS LISTED BY SUB-SECTION NUMBER 


(U) The following investigative methods are listed by DIOG Sub-Section number: 
{8.3.1 (U) Public information. 


18.5.2 (U) Records or information - FBI and DOJ. 


48.5.3 


(U) Records or information - Other federal. state. local, tribal. or forcign government 
agency. 


(U) On-line services and resources. 
(U) CHS use and recruitment. 


6 (U) Interview or request information from the public or private entities. 


§ (U) Physical Surveillance (not requiring a court order). 


48.5.9 (U) Grand jury subpoenas — to providers of electronic communication services or remote 
computing services for subscriber or customer information only in Type 1 & 2 Assessments. 


| (U) Consensual monitoring of communications, including electronic communications. 
(U) Intercepting the communications of a computer trespasser. 

8.6.3 (U) Closed-circuit tclevision/vidco surveillance. direction finders. and other monitoring 
devices. 
18.6.4 (U) Administrative subpoenas. 


18.6.5 (U) Grand jury subpoenas. 


© (U) National Security Letters. 
8.6.7 (U) FISA Order for business records. 


8 (U) Stored wire and electronic communications and transactional records. 


18.6.9 (U) Pen registers and trap/trace devices. 
© (U) Mail covers. 


U) Polygraph examinations. 


18.6.12 (U) Searches that Do Not Require a Warrant or Court Order (Trash Cover, Abandoned 
Property from a Public Receptacle, Administrative Inventory Search of a Lost/Misplaced Item) 
and Inventory Searches Generally 


U) Undercover operations. 
18.7.1 (U) Searches — with a warrant or court order. 


2 (U) Electronic surveillance — Title II. 
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12 U) Electronic surveillance — FISA and FISA Title VII (acquisition of foreign intelligence 
information). 


18.1.2 (U) INVESTIGATIVE METHODS LISTED BY NAME (ALPHABETIZED) 
(U) The following investigative methods are listed alphabetized by DIOG name: 
(U) Administrative subpoenas. (Section 18.6.4) 
5) 


(U) CHS use and recruitment. (Section 


(U) Closed-circuit television/video surveillance, direction finders, and other monitoring devices. 
(Section 3) 


(U) Consensual monitoring of communications, including electronic communications. (Section 
18.6.1) 


(U) Electronic surveillance — FISA and FISA Title VII (acquisition of foreign intelligence 
information). (Section {8.7.3) 


(U) Electronic surveillance — Tide III. (Section 18.7.2) 
(U) FISA Order for business records. (Section 18.6.7) 
(U) Grand jury subpoenas. (Section 18.6.5) 


9. 


(U) Grand jury subpoenas —to providers of electronic communication services or remote 
computing services for subscriber or customer information only in Type 1 & 2 Assessments. 
(Section 


(U) Information voluntarily provided by governmental or private entities. (Section 18.5.7) 


(U) Intercepting the communications of a computer trespasser. (Section 


(U) Interview or request information from the public or private entities. (Section | 
(U) Mail covers. (Section 18.6.10) 
(U) National Security Letters. (Section 


(U) On-line services and resources. (Section 18 


(U) Pen registers and trap/trace devices. (Section 18.6.9) 


(U) Physical Surveillance (not requiring a court order). (Section 


(U) Polygraph examinations. (Section 18.6.11) 
bi 
(U) Records or information - FBI and DOJ. (Section 18.5.2) 


(U) Recor 
(Section 


(U) Public information. (Section 


or information - Other federal, state. local. tribal. or foreign government agency. 


(U) Searches — with a warrant or court order. (Section ik 
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(U) Searches that Do Not Require a Warrant or Court Order (Trash Cover. Abandoned Property 
from a Public Receptacle, Administrative Inventory Search of a Lost/Misplaced Item) and 
Inventory Searches Generally. (Section 


(U) Stored wire and electronic communications and transactional records. (Section 18.6 
g 


(U) Undercover Operations. (Section į 


18.1.3. (U) GENERAL OVERVIEW 


(U/PORO} The conduct of Assessments. Predicated Investigations (Preliminary Investigations 
and Full Investigations) and other activities authorized by the Attorney General’s Guidelines for 
Domestic FB] Operations (AGG-Dom) may present choices between the use of different 
investigative methods (formerly investigative “techniques”) that are each reasonable and 
effective based upon the circumstances of the investigation, but that are more or less intrusive, 
considering such factors as the effect on the privacy and civil liberties of individuals and the 
potential damage to reputation. The least intrusive method if reasonable based upon the 
circumstances of the investigation is to be used in such situations. However. the choice of 
methods is a matter of judgment. The FBI is authorized to use any lawful method consistent with 
the AGG-Dom, even if intrusive. where the degree of intrusiveness is warranted in light of the 
seriousness of a criminal or national security threat or the strength of the information indicating 
its existence, or in light of the importance of the foreign intelligence sought to the United States’ 
interests. (AGG-Dom, Part I.C.2.) 


(U) The availability of a particular investigative method in a particular investigation may depend 
upon the level of investigative activity (Assessment, Preliminary Investigation. Full 
Investigation, and Assistance to Other Agencies). 


18.1.4 (U) CONDUCTING INVESTIGATIVE ACTIVITY IN ANOTHER FIELD OFFICE’S 
AOR 


(U) Investigative information that may be within another field office’s AOR can generally be 
obtained by setting an investigative lead to that field office. However, investigative 
circumstances may require employees to travel to another office’s AOR to conduct investigative 
ity. In such circumstances. an employee, with the approval off and the 
in the other field office, may enter that office’s AOR and 
conduct the necessary invesugative activity (e.g. interview). However, if unplanned 
investigative activities or exigent circumstances prevent an employce from obtaining advance 


Co pi advanced þefore entering another field office’s AOR. 
notification should be made as soon as practicable to a S E 
the other office’s AOR, including the type of investigative activity(s) that occurred and the 
circumstances that made obtaining prior approval and concurrence unfeasible. 


18.2 (U) LEAST INTRUSIVE METHOD 


(U) The AGG-Dom requires that the "least intrusive” means or method be considered and—if 
reasonable based upon the circumstances of the investigation—used to obtain intelligence or 
evidence in licu of more intrusive methods. This principle is also reflected in Executive Order 
12 which governs the activities of the United States intelligence community (USIC). The 
concept of least intrusive method applies to the collection of intelligence and evidence. 
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(U) Selection of the least intrusive means is a balancing test as to which FBI employees must use 
common sense and sound judgment to effectively execute their duties while mitigating the 
potential negative impact on the privacy and civil liberties of all people encompassed within the 
Assessment or Predicated Investigation, including targets, witnesses. and victims. This principle 
is nol intended to discourage investigators from seeking relevant and necessary intelligence, 
information, or evidence, but rather is intended to encourage investigators to choose the least 
intrusive—yet still reasonable —means from the available options to obtain the material. 
Additionally. FBI employces should operate openly and consensually with United States persons 
(USPERs) to the extent practicable when collecting foreign intelligence that does not concern 
criminal activities or threats to the national security. 

(U) DIOG Section 4.4 describes the least intrusive methods concept and the standards to be 
applied by FBI employees. 


18.3. (U) PARTICULAR INVESTIGATIVE METHODS 


(U//FORO) All lawful investigative methods may be used in activities under the AGG-Dom as 
authorized by the AGG-Dom. Lawful investigative methods include those investigative methods 
contained in this DIOG as well as additional investigative methods and resources authorized in 
other FBI policy and guidance (for example, future additions to DIOG Sections 18. as well as 
PGs). In some instances the authorized investigative methods are subject to special restrictions or 
review or approval requirements. (AGG-Dom, Part V.A.) 


18.3.1 (U) USE OF CRIMINAL INVESTIGATIVE METHODS IN NATIONAL SECURITY 
INVESTIGATIONS 


(U//FEHO} Because national security investigations may implicate criminal issues as well. the 
availability of criminal investigative methods should be considered when appropriate. However, 
any use of criminal investigative methods should be closely coordinated with FBIHQ. both 
operational units and the NSLB. prior to any anticipated use of this criminal investigative 
process. The NSLB maintains liaison with DOJ OI respecting the use of FISA authorized 
investigative methods in national security investigations. 


18.4 (U) INFORMATION OR EVIDENCE OBTAINED IN ASSESSMENTS AND 
PREDICATED INVESTIGATIONS 


(U) The use, retention and/or dissemination of information obtained during authorized 
investigations must comply with the AGG-Dom and the DIOG. If the originator of information 
reported to the FB] characterizes an individual, group, or activity in a certain way, and that 
characterization should be documented for completeness of the FBI record, the FBI record (i.c.. 
302, EC. LHM) should reflect that another party, and not the FBI. is the originator of the 
characterization. 


(U) During the course of an Assessment or Predicated Investigation, FBI employees lawfully 
may collect or passively receive items of evidence or intelligence from a variety of sources. 
Experience has demonstrated that the relevance of every item of evidence or intelligence 
collected or received is not always apparent at the time it is obtained. Accordingly, FBI 
employces have wide latitude to establish or determine the relevance of information as the 
Assessment or investigation develops. Nevertheless, as a matter of administrative efficiency and 
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sound business practice. if an FB] employee obtains an item of evidence which clearly is not 
relevant to the Assessment or investigation and there is no foreseeable future evidentiary or 
intelligence value of the item for the FBI or the USIC, the item should be returned or destroyed 
as circumstances warrant. with a record of the disposition documented in the file or on the FD-71 
or Guardian (FD-7 1a). In the alternative, such item of evidence may be sequestered in the 
investigative file. If it is later determined that the item of evidence is relevant, the item may be 
used in the investigation upon such determination. The determination of relevancy will be made 
on a case-by-case basis with supervisory direction and may include consultation with the 
appropriate federal prosecuting office and/or the Chief Division Counsel (CDC) or the Office of 
the General Counsel (OGC). This policy does not supersede Sections 18.6.4.1.5 (Administrative 
Subpoenas); 18.6.5.1 (Federal Grand Jury Subpoena); 18.6.6.1.7 (National Security Letters); or 
18.6.7.1.6 (FISA Order for Business Records). or any requirement imposed by statute. regulation 
or other applicable law. 


18.5 (U) AUTHORIZED INVESTIGATIVE METHODS IN ASSESSMENTS 
(U) See AGG-Dom, Part II.A.4. 
(UFOO) D-71, in Guardian bIE 


(U) In conducting an Assessment. only the following investigative methods are authorized: 


5 


A) (U) Public information. (Sce Section 
B) (U) Records or information - FBI and DOJ. (Sec Section 1& 


C) (U) Records or information - Other federal, state, local, tribal, or foreign government agency. 
(See Section $8.5.3) 


D) (U) On-line services and resources. (See Section 


E) (U) CHS use and recruitment. (See Section } 


F) (U) Interview or request information from the public or private entities. (See Section 


G) (U) Information voluntarily provided by governmental or private entities. (See Section 1 


H) (U) Physical Surveillance (not requiring a court order}. (See Section 18.3.4) 


1) (U/FOUS) Grand jury subpoenas - to providers of electronic commun on services or 
remote computing services for subscriber or customer information only during a Type 1 & 2 


Assessment (See Sectio: 


(U/FOGO} In Assessments, supervisory approval is required prior to usc of the following 
investigative methods: certain interviews. tasking of a CHS. and physical surveillance not 


bTE 
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18.5.1 (U) INVESTIGATIVE METHOD: PUBLIC INFORMATION (“PUBLICLY 
AVAILABLE INFORMATION”) 
(U) See AGG-Dom, Part II.A.4.a and Part VILL. 
18.5.1.1 (U) SCOPE 
(U//FOUS) Public information is “Publicly Available Information” that is: 

A) (U) Published or broadcast for public consumption; 

B) (U) Available on request to the public; 

C) (U) Accessible on-line or otherwise to the public; 

D) (U) Available to the public by subscription or purchase; 

E) (U) Made available at a meeting open to the public; 

F) (U) Obtained by visiting any place or attending an event that is open to the public (e.g.. public 
places); or 

G) (U) Observed, heard. smelled, detected or obtained by any casual observer or member of the 
public and does not involve unconsented intrusion into private places. 


(U//FOH@) The phrase “observed, heard, smelled, detected or obtained by any casual 
observer or member of the public” includes, for example, plain view observations; 
overhearing a conversation taking place at an adjacent table in a public restaurant; odor 
detection (by a person. drug dog. or technical device) emanating from a vehicle, in a public 
place, or from locations to which the employee has gained lawful access; searching property 
that has been intentionally abandoned, including property discarded in public trash containers 
or public dumpsters (but does not include a “trash cover” as set forth in DIOG Section 
18.6.12). 


(UABOUO) The following are examples: 


1) (U) Viewing the vehicle identification number or personal property that is exposed to 
public view and may be seen when looking through the window of a car that is parked in 
an arca that is open to and accessible by members of the public; 


2) (U) The examination of books and magazines in a book store or the purchase of such items. 
See Maryland v. Macon, 472 U.S. 463 (1985); and 
3) (U) A deliberate overtlight in navigable air space to photograph marijuana plants is not a 
search, despite the landowners subjective expectation of privacy. See California v. 
Ciraolo, 476 U.S. 207 (1986). 
(U//FOUQ) Note: Consent Searches are authorized in Assessments. as well as in Predicated 
Investigations. 


(U/FOYOQ) Note: If the originator of information reported to the FBI characterizes an 
individual, group. or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record. the FBI record {i.c.. 302. EC. LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 
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18.5.1.2 {U} APPLICATION 


18.5.1.3 {U} APPROVAL 


(U//FOUD) Supervisory approval is not required for use of this method, except for the special 
rule for attending a religious service, even if it is open to the public. (See DIOG Section 
18.5.1.3.1) 
18.5.1.3.1 (UFOO) SPECIAL RULES: “SPECIAL RULE FOR RELIGIOUS 
SERVICES” AND “SPECIAL RULE FOR OTHER SENSITIVE 
ORGANIZATIONS” 


18.5.1.3.1.1 (U/POECC) SPECIAL RULE FOR RELIGIOUS SERVICES — 
REGARDLESS OF WHETHER IT IS OPEN TO THE GENERAL PUBLIC 


A) (U/FOPOT In Assessments. 
T employee attending a religio! Tvice overtly 


must have SSA approval. Higher approvals may be required under certain circumstances, such 


pete ey UDP (see DIOG Section 16), 
B) (U/FEUO) In Predicated Investi; a ee Re 
An FBI employee attending a religious service overtly must have SSA 


approval. Higher approvals may be required under certain circumstances, such as attendance 
that rises to the level of UDP (see DIOG Section 16 


Lo Je DIOG Section 18.6.13). 


18.5.1.3.1.2 (U//FOEO) SPECIAL RULE FOR OTHER SENSITIVE 


ORGANIZATIONS 


A) 


B) (U7POUO}Hn Predicated Inyestigations: 


18.5.1.4 {U} USE/DISSEMINATION 


(U//FERS) The use or dissemination of information obtained by this method must comply with the 
AGG-Dom and DIOG Section 14. 
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18.5.2 (U) INVESTIGATIVE METHOD: RECORDS OR INFORMATION — FBI AND 
DEPARTMENT OF JUSTICE (DOJ) 


(U) See AGG-Dom, Part II.A.4.b. 
18.5.2.1 (U) SCOPE 


(U/TFOUO) An FBI employce may access and examine FBI and other DOJ records and may 
obtain information from any FBI personnel or other DOJ personnel. Access to certain FBI 
records may be restricted to designated FBI] personnel because of the sensitive nature of the 
information in the record. the classification of the record. or the tool used to gather the 
information contained in the record. These include, but are not limited to: FBI records 
concerning human source identification; espionage investigations; code word; other 
compartunented information; records that include raw FISA collections; and Rule 6(e) 
material. 

(U//FOCC) Note: If the originator of information reported to the FB] characterizes an 
individual. group, or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.c., 302, EC, LHM) should reflect that 
another party, and not the FBI. is the originator of the characterization. 


18.5.2.2 (U) APPLICATION 
(Us 


18.5.2.3 (U) APPROVAL 


(U/FOUO} Supervisory approval is not required to use this method. except that if the use of 
records constitutes pattern-based data mining under the Federal Data Mining Reporting Act of 
2007, it must be reviewed and approved according to Section 18.5.2.4 below. 


18.5.2.4 (U) PATTERN-BASED DATA MINING 


(U/FPOGE) As used here. pattern-based data mining (PBDM) means queries or other analysis 
of electronic databases using two or more search criteria designed to discover or locate a 
predictive pattern or anomaly indicative of terrorist or criminal activity on the part of any 
individual or individ defined inj 

ny such analysis based solely on racial. ethnic. national origin or 
strictly prohibited. 


religious charactcristi 


(UFO) For purposes of this requirement. pattern-based data mining does not include 
activitics using one or more personal identifiers to identify an individual or analysis designed 
to discover links between a specific subject and unknown individuals or entities, even if the 
subject’s actual identity is not yet known. Pattern-based data mining does not include queries 
or analysis designed solely to identify potential human sources of intelligence nor docs it 
include activities designed to identify an individual or individuals associated with criminal or 
terrorist activity that has already occurred. 
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BIE 


cause the queries are being used to investigate a crime 
that has already occurred. Queries designed to identify individuals or entities who have had 
contact with a specific individual are not pattern-based data mining; rather, such queries are 
subject-based data mining, even if the specific individual’s actual identity is presently 
unknown. 


(U/FOEO+ The majority of data analysis performed during FBI Assessments and Predicated 
Investigations is based on specific individuals or events and therefore docs not constitute 
pattern-based data mining because it is cither link analysis or is not predictive of future 
behavior. 

(U/FOUO} A Privacy Threshold Analysis (PTA) for pattern-bascd data mining must be 


completed and forwarded to the ce. and Civil Liberties Unit, OGC. See the Privacy 
, for additional details. 


(UIFEBO) The Sensitive Operations Review Committee (SORC) must also receive notice of 
any Proposal t to use paler: rbased data mining as denges above. Adiionally pursuant | to the 
LA Da Mi 


Reguirements Poli 


y DE A SODS 
18.5.2.5  (U) Usr/Disse 


(U//FOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


(UPOS) The request for the records and the records received from DOJ and used during an 
Assessment or Predicated Investigation must be maintained as part of the appropriate file 


b7E 


26 (U) 42 U.S.C. § 2000ee-3 
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18.5.3. (U) INVESTIGATIVE METHOD: RECORDS OR INFORMATION — OTHER 
FEDERAL, STATE, LOCAL, TRIBAL, OR FOREIGN GOVERNMENT AGENCY 


(U) See AGG-Dom, Part II.A.4.c. 
18.5.3.1 (U) SCOPE 


(U//F@9) An FBI employce may access and examine records maintained by. and request 
information from, other federal. state, local, or tribal. or foreign governmental entities or 
agencies. When requesting information using this authority, care must be taken to ensure the 
entity to which the request is made understands that it is not compelled to provide such 
information or create a new record to assist the FBI. 


(U//FOUS) Note: If the originator of information reported to the FB] characterizes an 
individual, group. or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.c., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 


18.5.3.2 (U) APPLICATION 
U; b7E 


18.5.3.3 (U) APPROVAL 
(U//FE8O ee 


(U//FOUO} Requests to other Federal Agencies: The FBI may request. for a law 
enforcement purpose. that another federal agency disclose Privacy Act-protected records 
through a written request (5 U.S.C. 552a(b){7)). Such written requests must be for a civil or 
criminal law enforcement purpose and must be made by the Director or his designee. (See 28 
CFR 16.40(c); OMB Guidelines. 40 Fed. Reg. at 28 sec. 955.) Pursuant to these provisions, 
the Director hereby delegates his authority to request formally from federal agencies 
information and records otherwise protected from disclosure by the Privacy Act. at FBIHQ, to 
all Section Chiefs and above, and in the field, to all SACs and ADICs. This authority may not 
be redelegated to a person below the rank of SAC in the field and SC in FBIHQ. 


(U) The FBI may also request another federal agency to disclose Privacy Act-protected 
records pursuant to that agency’s published routine uses. See 5 U.S.C. sec. 552a(b)(3). These 
requests need not be made in writing, and there are no restrictions on which FBI personnel 
may ask for such information. 


(U/FOUO) Requests to Foreign Agencies: Requests for records or information from a 
foreign government entity or agency must be appropriately coordinated through the applicable 
FBI LEGAT office. International Operations Division (IOD). INTERPOL. relevant FBIHQ 
operational division, and/or DOJ Office of International Affairs. as necessary. Direct contact 
with foreign government agencies is authorized in certain circumstances. such as an imminent 
threat situation. 
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(U/7FOUS) If the analysis of records obtained in this manner constitutes Pattern-based Data 
Mining (PBDM) under the Federal Data Mining Reporting Act of 2007. it must be reviewed 
and approved according to Section 18.5.2.3, above. 


(U/FFOUO} Example: 


18.5.3.4 (U) USE/DISSEMINATION 


(UAFEH8) The use and/or dissemination of information obtained by this method must 
comply with the AGG-Dom and DIOG Section 14. 

(U//FQOHE) The request for the records and the records received from an outside entity and 
used-during an Assess redice vestigati $ aintained as pari a 


ca a file 
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18.5.4 (U) INVESTIGATIVE METHOD: ON-LINE SERVICES AND RESOURCES 
(U) See AGG-Dom, Part II.A.4.d. 
18.5.4.1 (U) SCOPE 
(U//F680) An FBI] employee may use any publicly available on-line service or resource 


including those that the FBI has obtained by subscription or purchase for official usc, 
including services available only to law enforcement entities. 

(U//FOUD) Note: If the originator of information reported to the FB] characterizes an 
individual, group. or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record. the FBI record {i.c.. 302. EC. LHM} should reflect that 
another party. and not the FBI, is the originator of the characterization. 


18.5.4.2 (U) APPLICATION 
(U/FFOUS) This investigative method may be used prior to opening an Assessment, in 


A ments, Predicated Investigations, forcign intelligence collection investigations. and for 
assistance to other agencies. 


18.5.4.3 (U) APPROVAL 


(U/FOLR) Supervisory approval is not required to use this method, although subscribing to 
or purchasing any new service or resource must be done according to FBI contracting 
procedures. 


(U//FOU@) Example: Publicly a s or resources include, but are not 
limited to} (Online resources that may be 
purchased by the FBI for official use include, but are not limited to} 


ilable on-lin 


18.5.4.4 (U) USE/DISSEMINATION 


(U/F630} The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


(U) See DOG Appendix & On-line hivestigations for additional information. 
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18.5.5 (U) INVESTIGATIVE METHOD: CHS USE AND RECRUITMENT 
(U) See AGG-Dom, Part II.A.4.e. 
18.5.5.1 (U) SCOPE 


(U/H2QU0) The FBI may use and recruit human sources in Assessments and Predicated 
Investigations in confor mity with the AGG-Dom, Attore, General Guidelines Regarding the 


In this context, “use” means obtaining information from, tasking, or 
otherwise operating such sources. See AGG-Dom, Part VIIV. 


(UAFOEEC) Note: If the originator of information reported to the FBI characterizes an 
individual, group. or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.c., 302, EC. LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 


18.5.5.2 (U) APPLICATION 


(UAFEHOQ) This investigative method may be used in Assessments. Predicated Investigations, 
foreign intelligence collection investigations, and for assistance to other agencies when it is 
not otherwise prohibited by AGG-Dom, Part III.B.2. 


(U) When collecting positive foreign intelligence, the FB] must operate openly and 
consensually with an USPER. to the extent practicable. 


(U/H2QU0} A CHS can be “used” in support of an Assessment and a Predicated Investigation 
or for the purpose of validating, vetting or determining the suitability of another CHS as part 
of an Assessment. 


18.5.5.3 (U) APPROVALS 


(U//FO88@) All investigative methods should be evaluated to ensure compliance with the 
admonition that the FBI should use the least intrusive method if reasonable based upon the 
circumstances of the investigation. That requirement should be particularly observed during 
an Assessment when using a CHS because the use of a CHS during an Assessment may be 
more intrusive than many other investigalive methods. Use of a CHS in an Assessment should 
take place only after considering whether there are effective, less intrusive means available to 
obtain the desired information. The CHS must comply with all constitutional, statutory. and 
regulatory restrictions and limitations. In addition: 


A) (FOUS) CHS usc and direction must be limited in focus and scope to what is necessary to 
d purpose and objective of the A: ment or Predicated 
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B) (UFI During an Ass Can A ) b7E 
E | the Special Rule for Religious Services and the Special 
Rule for Other Sensitive Organizations below) only to the extent that such information is 
necessary to achieve the specific objective of the Assessment. If such contact reveals 
information or facts about an individual, group or organization that mects the requirements to 
open a Predicated Investigation, a Predicated Investigation may be opened, as appropriate. 


C) (UFOS Special Rule for Religious Services — regardless of whether it is open to the 
general public: 


D (UAFEUO) In Assessments} bIE 
n employee atten mg a reugious service 


overtly must have SSA approval. Higher approvals may be required under certain 
circumstances, such as attendance that rises to the level of UDP (see DIOG Scction 16). 


2) (U//FOUOS In Predicated Inyestigations:[s—s—~—SCSCid bIE 
n FBI employee attending a religious service overtly must have 


SSA approval. Higher approvals may be required under certain circ) ces, such as 
attendance that rises to the level of UDP (see DIOG Section 16) 
[sce DIOG Section 18.6.13). 


D) (U/FOH9 Special Rule for Other Sensitive Organizations: 


1)_QU/FOUO) In Assessments: bIE 
2) (U//FOYO) In Predicated Investigations. bIE 
b7E 


E) (U/FFO06) Public Information: 


P  OMOBONon Publie mormon oe 
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his. 
principle does not, however, elimmate the ega! concept of a consent secari or the doctrine 
of misplaced confidence that may be relied on by the government to gain access to 
otherwise protected places or information when the CHS has been granted access by a 
consenting party and the CHS stays within the scope of the consent provided. The doctrine 
of misplaced confidence provides that a person assumes the risk when dealing with a third 
party that the third party might be a government agent and might breach the person's 
contidence 


(U) Example: 


U/POUO) Scenario: 


U/FOYO) Response: 


18.5.5.4 (U//FOUO) APPLICABILITY O! 
DURING CHS ONLINE AC 


E MISPLACED CONFIDENCE DOCTRI 


U/FOUS) 
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18.5.5.5 (U) USE/DISSEMINATION 
(U/FOGO} The use or dissemination of information obtained by this method must comply 
with the AGG-Dom, DIOG Section 14, and theL___] b7E 
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18.5.6 (U) INVESTIGATIVE METHOD: INTERVIEW OR REQUEST INFORMATION 
FROM THE PUBLIC OR PRIVATE ENTITIES 


(U) See AGG-Dom, Part II.A.4.f, AGG-Dom. Part II.B.4. 
18.5.6.1 (U) SCOPE 


(UFOO) An interview is the questioning of an individual (including a subject or target) in 
order to gather information that is pertinent to and within the scope of an authorized 
Assessment or Predicated Investigation, or otherwise within the scope of FBI authority. An 
“interrogation” is a type of interview. For purposes of this policy provision, the terms 
“interview” and “interrogation” are interchangeable. In accordance with DIOG Section 5.1.1, 
the initial questioning of a complainant is not an interview, nor is re-contacting a complainant 
to clarify information that was initially provided. Normally. an FB] employee should disclose 
the employee’s affiliation with the FBI and true purpose of the interview at the outset. The 
person being interviewed is voluntarily providing information and his/her Constitutional 
rights must be respected. 


(U#FOHOH! is the policy of the FBI that an employee?’ must not use force. threats. improper 
promises, or physical abuse when conducting an interview. or the threat of such abuse to the 
person being interviewed. or to any third party. It is also the policy of the FBI that an 
employee must not impose severe physical conditions on the person being interviewed. 


(U/-FOEO} All persons, whether in custody or not, located domestically or overseas, who are 
interviewed by FBI employees must be treated in accordance with FBI policy at all times. In 
addition, FBI employees must adhere. at all times. to the Constitution and laws of the United 
States, including but not limited to the prohibition against torture found in chapter 113C of 
ütle 18, United States Code. when conducting any interview or interrogation regardless of 
geographic location of the interview or interrogation. 


(U/H#OUQ) FB] employees may not obtain a statement by force, threats, or improper 
promises. FB] employees do not have the authority to promise leniency or immunity from 
prosecution. Additionally, the interviewer should make reasonable efforts to obtain 
information that is accurate, relevant, timely. and complete. An interview may only clicit a 
description of how an individual exercises a right guaranteed by the First Amendment to the 
Constitution if such information is pertinent to and within the scope of an authorized activity; 
similarly, regardless of how such information is elicited. it may not be maintained in FBI files 
unless it is pertinent to and within the scope of an authorized activity. 


(UAFOGO} Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. “Consent Searches” are authorized in Assessments, as well as in 
Predicated Investigations. 


U/FOUS) b7E 


27 The term “FBI employee” includes, but is not limited to, an operational/administrative professional staff 
person, intelligence analyst, special agent, task force officer (TFO), task force member (TFM), task force 
participant (TFP}, detailee, and FBI contractor. 
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(U/FEUC) Note: If the originator of information reported to the FBI characterizes an 
individual. group, or activity in a certain way. and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.c., 302, EC, LHM) should reflect that 
another party. and not the FBI. is the originator of the characterization. 


18.5.6.2 (U) APPLICATION 
(U/FEve 


18.5.6.3 (U) VOLUNTARINESS 


(U//FOGOs Information that is sought during an interview must be provided voluntarily. It is 
the policy of the FBI that an employee must not use force, threats, improper promises, or 
physical abuse when conducting an interview. or the threat of such abuse to the person being 
interviewed. or to any third party. It is also the policy of the FBI that an employce must not 
impose severe physical conditions on the person being interviewed. 


(U//FQUO) FBI employces do not have the authority to promise leniency or immunity from 
prosecution. If, during a non-custodial interview. the interviewee indicates he or she wishes to 
consult an attorney, the interviewer should assess whether continuing the interview would 
negatively affect the voluntariness of any further information provided. In determining 
whether a statement has been given voluntarily, courts evaluate a “totality of the 
circumstances,” which may include consideration of the following factors 


A) (U/FOYO} Whether the interviewee was notificd of any charges against him/her or advised of 
his/her rights; 


B) (U/FOUO}The interviewee’s age. intelligence. experience, and physical condition: 

C) (U/FOUG) Whether there was any physical abuse or threats of abuse during the interview; 

D) (U/F@0O) The number of officers present and whether weapons were displayed during the 
interview; 

E) (U/FOUS) Whether threats or psychological pressure was used during the interview; 


F) (U/PEUOT Whether the interviewee was deprived of food, sleep, medication, or outside 
communication during the interview; 
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G) (U/FFE06) The duration of the interview, and whether any trickery, ruse, or deception was 
used; and 


H) (U//F@O) Whether there were any promises of leniency or other inducements made during 
the interview. 


(UFFOO) Sce Sections 18.5.6.3.8. 18.5.6.3.9, and 18.5.6.4.13 below for additional 
considerations when interviewing juveniles. 


(U/#FOtO) These factors arc illustrative. The presence of any one or more of the factors 
mentioned above will not necessarily make a statement involuntary. 


18.5.6.4 (U) APPROVAL / PROCEDURES 
(U//FOES) Generally, interviews do not require supervisory approval, except for: 
A) (U/AFOBO) Circumstances involving the Advice of Rights in Connection with Operational 
Terrorists inside the United States (See Section 18.5.6.4.1.4 below); 
B) {U) Contact with Represented Partics (See Section 18.5.6.4.5 below); 
C) (U) Member of the U.S. Congress and their Staffs (See Section 18.5.6.4.6 below); 
D) (U) White House Personnel (See Section 18.5.6.4.7 below); 
E) (U) Members of the News Media (See Section 18.5.6.4.8 below); and 


o ma N 


(U/FOH9) No policy or PG may contradict. alter or otherwise modify the interview 
standards of the DIOG, i.e., requiring approvals for other types of interviews not specified 
above, etc. PGs may, however, require prior notice to FBIHQ for other interview types. 


18.5.6.4.1. (U) Domestic CUSTODIAL INTERVIEWS” 


(U//FOCO) An FBI employce must advise a person who is in custody of his/her Miranda 
rights, per the £D-395 form, before beginning an interview inside the 
United States with the exception of questioning reasonably prompted by a concern for public 


safety (discussed below) including the exception of questioning reasonably prompted by a 
concern for public safety (See DIOG Section 18.5.6.4.1.3 Se 


18.5.6.4.1.4 below). It is critical that the person understand his/her rights before questioning. 
By signing the FD-395. the defendant acknowledges that he/she has been advised of his/her 
rights and is willing to proceed without a lawyer present. Once the advice of rights is provided 
and the interviewee voluntarily. knowingly, and intelligenUy waives those rights, the 
interview may proceed until such time as the interviewee invokes a right to silence and/or 
counsel j 


(U/FFOVO) A person is “in custody” for purposes of Miranda when his/her freedom of 
movement is significantly restricted. Custody can arise short of formal arrest when, judging 
from the totality of the circumstances, a reasonable person in the position of the interviewee 


“ol 
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would believe that he/she is in custody. A brief, temporary investigative detention is not 
custody provided it is reasonable in scope. In assessing whether a temporary detention is 
reasonable in scope and thus not custody for purposes of Miranda, factors to consider include 
the degree of force used to affect the detention, use of restraining devices and whether the 
individual was moved from the location of the stop. Employees can clarify custodial status by 
telling the person that he/she is not under arrest. See DIOG subsection 18.5.6.4.17.3 below 
regarding requirements for recording custodial interviews. All statements made during a 
custodial interview of persons arrested by the FBI for federal crimes,*! prior to initial 
appearance and while in a place of detention with suitable recording equipment, must be 
electronically recorded (with very limited exceptions as listed in DIOG subsection 
18.5.6.4.17.4, below). 


18.5.6.4.1.1 (U) MIRANDA WARNINGS REQUIRED DOMESTICALLY 
(U/FOUO) Miranda warnings are required when a person: 
A) (U//F@R6) Has been arrested and is in federal, tribal, state, or local custody; 


B) (U//#OWO) Is significantly restricted in his freedom of movement to a degree normally 
associated with a formal arrest; or 


C) (U//FOVO) Regardless of custody, has previously been formally charged, prosecution is 
pending. and the subject matter of the interview concerns the pending charge. 
(U/FE8) For the purposes of Miranda, an interview refers to express questioning and 
any words or actions that are reasonably likely to clicit an incriminating response. In a 
custodial interview. the individual must be advised of the names and official identities of 
the employee(s) conducting the interview, the nature of the inquiry. and provided 
Miranda wami per the FD-395 form. before being interviewed. After being advised 
of his/her rights. if an interviewee who is in custody, invokes the right to counsel and/or 
the right to remain silent, this must be honored and the interview must cease. However. 
once the advice of rights is provided and the interviewee voluntarily. knowingly, and 


intelligently waives those rights. the interview may proceed until such time as the 
interviewee invokes a right to silence and/or counsel. While an express waiver, including 
signing a waiver portion of the F] 


Once the interviewee invokes his or her right to remain silent and/or right to counsel, the 
interview must immediately be terminated. The fact that the interviewee invoked the right 
to counsel and/or the right to remain silent should be recorded on the FD-395 and the 
form should be executed in all other respects. 


18.5.6.4.1.2 (U) MIRANDA WARNINGS NOT REQUIRED DOMESTICALLY 
(U//FQ8@) There are certain custodial interviews in which the protection Miranda 
provides against sclf-incrimination may not be served by reading the standard warnings 
and obtaining a waiver. In the following circumstances, Miranda warnings are not 
required for custodial interviews: 


A) (U/FE8O} standard booking questions; 


3! This policy does not apply to a person arrested for a state or local crime during a joint or Task Force investigation. 
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B) (U4¥600) an interview of the incarcerated individual as a victim or witness in an unrelated 
matter that does not pertain to any pending charges against the interviewee; 


C) (U/FOU® the public safety exception (discussed in more detail below); and 


D) (U/FOUOF in connection with arrests of operational terrorists inside the United States 
(discussed in more detail below). 


18.5.6.4.1.3 (UAE ORO) PUBLIC SAFETY EXCEPTION 


(U//BQUQ} The warning and waiver of rights is not required when questions are asked 
that are reasonably prompted by a concern for public safety] 


This public safety exception could also apply to other 
situations where imminent threat{s) to the safety of law enforcement officers or 
member(s) of the public could be alleviated by questions necessary to neutralize the 
threat. 


18.5.6.4.1.4 (UHFOWVO) ADVICE OF RIGHTS IN CONNECTION WITH ARRESTS 
OF OPERATIONAL TERRORISTS INSIDE THE UNITED STATES? 

(U/FOY Identifying and apprehending suspected terrorists. interrogating them to 
obtain intelligence about terrorist activities and impending terrorist attacks, and lawfully 
detaining them so that they do not pose a continuing threat to our communities are critical 
to protecting the American people. The DOJ and the FBI believe that we can maximize 
our ability to accomplish these objectives by continuing to adhere to FBI policy regarding 
the use of Miranda warnings for custodial interrogation of operational terrorists who are 
arrested inside the United States: 


A) (U/EOHO) If applicable, agents should ask any and all questions that are reasonably 
prompted by an immediate concern for the safety of the public or the arresting agents without 
advising the arrestee of his Miranda rights.“ 

B) (U/FO8S) After all applicable public safety questions have been exhausted, agents should 
advise the arrestee of his/her Miranda rights and seek a waiver of those rights before any 
further interrogation occurs, absent the exceptional circumstances described below. 


? (UOUS) This guidance applies only to arrestees who have not been indicted and who are not known to be 
represented by an attorney. For policy concerning the interrogation of indicted defendants, see Section 18.5.6.4.1: 
and for policy concerning contact with represented persons. see DIOG Section 18.5.6.4.5. 

“UAPOROy For these purposes, an operational terrorist is an arrestee who is reasonably believed to be either a 
high-level member of an international terrorist group: or an operative who has personally conducted or attempted to 
conduct a terrorist operation that involved risk to li r an individual knowledgeable about operational details of a 
pending terrorist operation. 

HUHS) The Supreme Court held in New York v. Quarles, 467 U.S. 649 (1984), that if law enforcement 
officials engage in custodial interrogation of an individual that is "reasonably prompted by a concern for the public 
safety.” any statements the individual provides in the course of such interrogation shall not be inadmissible in any 
criminal proceeding on the basis that the warnings described in Miranda V. Arizona, 384 436 (1966), were not 
provided. The Court noted that this exception to the Miranda rule is a narrow one and that "in each case it will be 
circumscribed by the {public safety} exigency which justifies it.” 467 U.S. at 657. 
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C) (UFOO There may be exceptional cases in which. although all relevant public safety 
questions have been asked, agents nonetheless conclude that continued unwarned interrogation 
is necessary to collect valuable and timely intelligence not related to any immediate threat, and 
that the government=s interest in obtaining this intelligence outweighs the disadvantages of 
proceeding with unwarned interrogation.» 


(U/FOYO) In these exceptional cases. agents must seek SAC approval, which cannot be 
delegated, to proceed with an unwarned interrogation after the public safety questioning is 
concluded. Whenever feasible, the SAC will consult with FBIHQ (including OGC) and DOI 
attorneys before granting approval. Presentment of an arrestee may not be delayed simply to 
continue the interrogation, unless the arrestee has timely waived prompt presentment. 


(U//FOUO) The determination whether particular unwarned questions are justified on 
public safety grounds must always be made on a case-by-case basis based on all the facts 
and circumstances. In light of the magnitude and complexity of the threat often posed by 
terrorist organizations, particularly international terrorist organizations, and the nature of 
their attacks. the circumstances surrounding an arrest of an operational terrorist may 
warrant significantly more extensive public safety interrogation without Miranda 
warnings than would be permissible in an ordinary criminal investigation. Depending on 


(U/OHB) As noted above, if there is time to consult with FBIHQ (including OGC) and 
Department of Justice attorneys regarding the interrogation strategy to be followed prior 
to reading the arrestee his Miranda rights. the ficld office should endeavor to do so. 
Nevertheless. the agents on the scene who are interacting with the arrestee are in the best 
position to assess what questions are necessary to secure their safety and the safety of the 
public. and how long the post-arrest interview can practically be delayed while 
interrogation strategy is being discussed. 


18.5.6.4.2 (U//FOEO) MIRANDA WARNINGS FOR SUSPECTS IN CUSTODY OVERSEAS 


(U/LE0448) The decision to use or not use Miranda warnings during an overscas custodial 
interrogation will have to be made on a case-by-case basis and weigh many factors. Overall. if 
there is a reasonable likelihood of a prosecution in a U.S. civilian criminal court of the person 
being interrogated while in custody overseas. agents should discuss with FBIHQ, FBI OGC. 
and DOJ whether warnings should be provided to the person being interrogated. Once the 
determination is made to provide Miranda warnings as part of an overseas custodial 


35(U// O88) The Supreme Court has strongly suggested that an arrestee's Fifth Amendment right against 
self-incrimination is not violated at the time a statement is taken without Miranda warnings, but instead may 
be violated only if and when the government introduces an unwarned statement in a criminal proceeding 
against the defendant. See Chavez v. Martinez, 538 U.S. 760, 769 (2003) (plurality op.); id. at 789 (Kennedy, J., 
concurring in part and dissenting in part); of also id. at 778-79 (Souter, J., concurring in the judgment); See 
also United States v. Patane, 542 US. 630, 641 (2004) (plurality opinion) (“[VJiolations [of the Fifth 
Amendment right against self-incrimination] occur, if at all, only upon the admission of unwarned statements 
into evidence at trial."); United States y. Verdugo-Urguidez, 494 U.S. 259, 264 (1990} ("[A] violation [of the 
Fifth Amendment right against self-incrimination] occurs only at trial."). 


18-22 


UNCLASSIFIED -FGR-GFFICIAE SSE ONLY Version Dated: 


March 3, 2016 


bIE 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide §18 


interrogation, if the person being interrogated invokes his right to remain silent or consult 
with an attorney, this invocation should be honored. If use of Miranda warnings is appropriate 
given the circumstances of the case. the following DOJ-approved modified waiver form 
should be used. The form is the ¥ 


rd Advice of Rights for Suspects in Forei 


18.5.6.4.3 (U) CONSTITUTIONAL RIGHTS TO SILENCE AND COUNSEL UNDER 
MIRANDA 


A) (U/FOUO) Silence: If a custodial interviewee invokes his/her right to remain silent. FBL 
employees should not attempt a subsequent interview until a significant period of time has 
clapsed (a two-hour period has been held to be significant) or the interviewee requests to be 
interviewed anew. In cither case, an FBI employee will ensure that the interviewee is again 
advised of his/her Miranda rights and indicates that he/she understand those rights before 
further questioning. If the interviewee again asserts his/her right to remain silent or the right to 
counsel, questioning must cease at that time. Assertion of the right to silence, like assertion of 
the right to counsel, must be unequivocal and unambiguous. A waiver of the right to remain 
silent occurs when an interviewee knowingly and voluntarily makes a statement; assertion of 
the right to remain silent requires more than mere silence in the face of questioning. This right, 
like the right to counsel, can be invoked at any time during custodial interrogation. Agents 
may continue questioning someone who has not clearly invoked his/her right to remain silent, 
but if the custodial interviewee asserts his/her right to silence, questioning must cease at that 
time. 


B) (U/#@8@) Counsel: If a custodial interviewee invokes his/her right to counsel, questioning 
must cease. FBI employees may not attempt a subsequent interview unless counsel is present, 
the custodial interviewee initiates contact, or there has been a break in custody of at least 14 
days. 


1) (U/FE8O) When a custodial interviewee who has invoked his/her right to counsel 
initiates a subsequent interview, an FBI employee must ensure that the interviewee is 
advised of and understands his/her Miranda rights before proceeding with the interview. 
Not every statement by a custodial interviewee can fairly be interpreted as initiating a 

subsequent interview. In order to constitute the initiation of an interview, the custodial 

interviewee must either directly request such or use words that are reasonably interpreted 
as expressing a desire to be interviewed. If the words used are ambiguous, the FBI 
employee should clarify the custodial interviewee’s intent by asking directly whether the 
custodial interviewee wants to be interviewed. The words and responses, if any, to such 
clarifying questions should be documented. General conversation by a custodial 
interviewee cannot be interpreted as indicating a desire to be interviewed and cannot be 
used standing alone to predicate a second interview after the right to counsel has been 
invoked. If the interviewee again asserts his/her right to counsel, or invokes his/her right to 
silence, questioning must cease at that time. 


2) (U/AF@O) When an uncharged and/or unrepresented interviewee who has previously 
invoked his/her right to counsel experiences a break-in-custody of at least 14 days. he/she 
may be approached for a subsequent interview. FBI employees. however, must ensure that 
the custodial interviewee is again advised of and waives his/her Miranda rights before 
proceeding with the interview. A break-in-custody for these purposes can occur even if an 
interviewee is continuously incarcerated. Questions as to what constitutes a break-in- 
custody should be directed to the CDC or OGC. 
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3) (UFOO) Contact with a represented person outside the presence of his/her counsel may 
implicate state ethics rules for attorneys (AUSAs). Before making such contact, employees 
are encouraged to contact the CDC, OGC, or the USAO. Once a represented person has 
been charged, information may only be elicited from the person: 1) regarding an unrelated 
or uncharged matter or 2) when counsel is present. Questions as to whether an individual is 
in fact represented or may be questioned as to a particular matter should be directed to the 
CDC or OGC. 


18.5.6.4.4 (U) SIXTH AMENDMENT RIGHT TO COUNSEL 


(U//FORO) The Sixth Amendment Right to Counscl requires the government to advise and 
obtain a waiver of the Right to Counsel prior to interviewing the person to whom the right has 
attached. The Right to Counsel attaches upon indictment regardless of whether the indicted 
person realizes an indictment has been returned. The Right to Counsel also attaches upon the 
filing of information and at the time of an initial appearance on a Federal Complaint. The 
Right to Counsel is offense specific. When applicable, a warning regarding the Right to 
Counsel and subsequent knowing and voluntary waiver must occur prior to an interview, 
regardless of whether the person is in custody. Providing a person with a Miranda warning 
and obtaining a waiver per the use of Form FD-395 will permit the interview of the person 
after the Right to Counsel has attached. The Sixth Amendment right to counsel does not 
prohibit the government from re-contacting the subject if the subject refuses initially to waive 
this right or otherwise has requested or obtained counsel following an Initial Appearance. 
However, further attempts to interview the subject may be prohibited athe: subject invoked 
his right to counsel and remained in continuous custody or there wa 
custody (consistent with Miranda and its progeny). In addition, 


18.5.6.4.5 (U) CONTACT WITH REPRESENTED PERSONS 


(U//EQUO) CDC or OGC review is required before contact with represented persons in the 
absence of prior notice to counsel. Such contact may implicate legal restrictions and affect the 
admissibility of resulting evidence. Hence. if an individual is known to be represented by 
counsel in a particular matter. the CDC must follow applicable law and DOJ procedure when 
reviewing the request to contact the represented individual in the absence of prior notice to 
counsel. The SAC, CDC, or their designees. and the United States Attorney or his or her 
designees must consult periodically on applicable law and DOJ procedure relative to contact 
with represented persons. The field office may raise inconsistent application of: (i) state ethics 
rules; or (ii) rules for contacts with represented persons with the USAO and request that it 
consult with the DOJ Professional Responsibility Advisory Office. (AGG-Dom. Part V.B.1) 


18.5.6.4.6 (U) MEMBERS OF THE UNITED STATES CONGRESS AND THEIR STAFFS 


(UFOO Gencrally. FB] employees may accept information offered from Congressional 
offices just as they would accept information from other sources, and they may act upon it 
accordingly. 
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18.5.6.4.7 (U) WHITE HOUSE PERSONNEL 


(U/FSYO) FBI employees may accept information offered by White House personnel just as 
they would accept information from other sources, and they may act upon it accordingly. L] b7E 


dditional 
guidance regarding contact with White House personnel may be found in the AG 
Memorandum captioned “Communications with White House and Congress” dated May 11, 
2009. (Sce DIOG A, 


18.5.6.4.8 (U) MEMBERS OF THE NEWS MEDIA 
18.5.6.4.8.1 (U) APPROVAL REQUIREMENTS 


(U) Attorney General approval, including notice to the Director of the DOJ’s Office of 
Public Affairs, must be obtained prior to conducting an interview of a member of the 
news media for any offense which the member of the news media is suspected of having 
committed in the course of, or arising out of. the coverage or investigation of a news 
story, or while engaged in the performance of his/her official duties as a member of the 
news media. 


b7E 


(U#BOUO) Requests for this approval must be submitted with an EC to the AD of the 
operational FBIHQ division that is responsible for the investigative classification and the 
AD of the Office of Public Affairs (OPA). The requesting EC must be reviewed by the 
CDC and approved by the SAC after coordinating the request with the local USAO. The 


EC must contain the necessary facts and investigative justification for intervie: 
consistent with the DOJ guidelines set forth in 28 C.F.R. § 50.10(1. 


(U) Note: 28 C.F.R. § 50.10(b)(1)(ii) provides guidance on categories of individuals and 
entities not covered under the requirements sct out above. 


18.5.6.4.8.1.1 (U) EXIGENT CIRCUMSTANCES 


e—a 
authorize the questioning of a member of the news media as described in DIOG 

subsection 78.5.6.4.8.1 if he/she determines that exigent use of such a technique is 
necessary 
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b7E 


(U) Sec also the } 
Media Policy. and the DOJ N. 


18.5.6.4.8.2 (U) USE OF SUBTERFUGE WITH A MEMBER OF THE NEWS MEDIA 
(U/FEBS) To the extent operational needs allow, investigators must operate openly and 


bIE 


decide whether to approve the request. If the request requires approval by DOJ (because 
the interview is related to an offense committed by the member of the news media during 
the course of news gathering) the AD of the operational division is responsible for 
submitting all requests for approval to the DOJ per 28 C.F.R. 50.10. 


(U/H2QUQ) FBIHQ operational div 


n PGs may contain additional notice requirements. 


18.5.6.4.9 (U) DURING AN ASSESSMENT - REQUESTING INFORMATION WITHOUT 
REVEALING F BI AFFILIATION OR THE TRUE PURPOSE OF A REQUEST 


A) (U/AFOUQ) In the normal course of an interview, an FBI employee should divulge the 
employee's affiliation with the FBI and the true purpose of the interview. 


bIE 


B) (UVE bIE 
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18.5.6.4.10 
(U#FERO 
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(U) CONSULTATION AND DISCUSSION 


(U) EXAMPLES 


18.5.6.4.11.1 (U) EXAMPLE 1 


(Us 


§18 


18.5.6.4.11.2 (U) EXAMPLE 2 


U/PFOUS, 


Pee 


18.5.6.4.11.3 (U) EXAMPLE 3 


(UAFO88) 


(U// 
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18.5.6.4.11.4 (U) EXAMPLE 4 
(U/EOUO] 


§18 


Ae 


18.5.6.4.11.5 (U) EXAMPLE S5 
(UFOO 


(U/ 


18.5.6.4.11.6 (U) EXAMPLE 6 
(U/FORO 
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18.5.6.4.11.7 (U) EXAMPLE 7 


(Ul) 


18.5.6.4.11.8 (U) EXAMPLE8 


(UFOO: 


(U/FORO 


18.5.6.4.11.9 (U) EXAMPLE 9 


(U/FOGS) 


(U/A 
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18.5.6.4.12 (UAFORO} PREDICATED INVESTIGATIONS - REQUESTING INFORMATION 
WITHOUT REVEALING F BI AFFILIATION OR THE TRUE PURPOSE OF A 
REQUEST 


(U/AFOUS) In the normal course of an interview. the FB] employee should divulge the 
employee’s affiliation with the FBI and the true purpose of the interview. 


bIE 


(UPOO) b7E 


18.5.6.4.13 (U)INTERVIEWS OF JUVENILES 


(U/FEO) When determining whether to interview a juvenile (anyone under the age of 
eighteen) who does not fall within the provisions of the JDA above, e.g.. when interviewing a 
juvenile as a witness or subject prior to arrest, and. if so, determining the scope and tactics 
that will be used, the FBI employee should consider the age and competency of the juvenile, 
whether the juvenile is emancipated, the juvenile’s relationship to the suspect(s), safety 
concerns, the gravity of the offense at issue, any alternative sources of evidence, the 
importance of the information or potential testimony to the investigation, and the juvenile’s 
degree of involvement, if any, with the offense. If the interview is custodial, compliance with 
the provisions of the Juvenile Delinquency Act (JDA) below is necessary. In determining 
whether a juvenile is in custody the test remains an objective test -was there a formal arrest or 
a deprivation of freedom of movement equivalent to an arrest. However, with respect to 
juveniles, if the juvenile’s age is known to the interviewer or is objectively apparent, the 
juvenile’s age is to be considered in the custody analysis. This is not to say that age is the 
etermining or decisive factor in every case, but it recognizes that age is to be considered 
given a reasonable adult may view the circumstances surrounding the interview differently 
than a reasonable juvenile. If the juvenile is placed under arrest. the procedures listed in 
8.5.6.4.14 must be followed. If not under arrest, but based on the objective circumstances 
surrounding the interview, including the juvenile’s age, the juvenile is deemed to be in 
custody, the interviewer should advise the juvenile of their rights as set forth in the FD-395 
and cease the interview if the juvenile invokes a right. Parental consent for a juvenile 
interview should be obtained when feasible under the circumstances of the investigation. 


A) (UFFE88) Special consideration should be given to child interviews and to interviews of 
juveniles who are of a tender age. maturity, or have a significant developmental disability. To 
the extent appropriate, agents should make use of local child protective services to aid in 
interviewing a child -- especially for an offense involving sexual exploitation of the child. The 
agents should consider secking approval to video and/or audio record child interviews to 
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address potential allegations that the child was manipulated and to have an unimpeachable 
record in case the child's statement changes. 


B) (U/O¥O) Federal statutes and the Attorney General Guidelines on Victim and Witness 
Assistance require federal investigators to utilize sensitive and developmentally appropriate 
practices designed to elicit the most accurate information from child victims and witnesses and 
to reduce unnecessary and additional trauma to these children. An interview should be 
appropriate for the age and developmental level of the child. It may be advisable in some 
instances for FBI employees to seek assistance with interviewing children — possibly by 
utilizing local child protective services — particularly, when the child is very young, 
developmentally disabled, or extremely traumatized. Interviews of child victims and 
witnesses, regardless of the type of crime, should be conducted by personnel properly trained 
in the techniques designed to best elicit accurate information from a child while minimizing 
additional trauma. 


18.5.6.4.14  (U) INTERVIEWS OF JUVENILES AFTER ARREST 


(U//FOGO) Under the Juvenile Delinquency Act (JDA). a juvenile is anyone who commits a 
federal crime before his or her eighteenth birthday and who has not yet reached age twenty- 
one (21) before being charged. The provisions of the JDA, 18 U.S.C. § 5031 et seq.. apply 
upon arrest. When an agent interviews a juvenile in custody, after arrest and prior to initial 
appearance while in a place of detention with suitable recording equipment, the statement 
must be recorded in accordance with DIOG subsection 18.5.6.4.17.3. 


A) (U//P@O) Whenever a juvenile is arrested for a violation of federal law. he/she must be 
immediately advised of his/her legal rights and the United States Attorney must be notified. 
The juvenile’s parents. guardian or custodian must also be immediately notified of his/her 
arrest as well as his/her rights and the nature of the alleged offense. After notification has been 
made, FBI employces must allow a parent, guardian, or custodian access to the juvenile if 
requested by the juvenile or by a parent. guardian or custodian of the juvenile. The juvenile 
must be promptly taken before a magistrate if a magistrate is available. If no magistrate is 
immediately available, the juvenile must be taken to a magistrate without unduc delay. 


B) (U//FOUG) Whether a juvenile may be interviewed for a confession or admission of his own 
guilt between the time of his arrest for a federal offense and hi al appearance before the 
magistrate depends on the law of the circuit in which the arrest occurs. If the interrogation is 
not allowed under the law of the circuit. information volunteered by the arrested juvenile 
concerning his own guilt should be recorded in the FBI employee's notes for use in subsequent 
proceedings; clarifying questions may be asked as necessary to make certain the FBI 
employee correctly understands what the juvenile intends to say. The volunteered statement 
may be reduced to writing if such action does not involve any delay in the juvenile's 
appearance before the magistrate. Any questions concerning the law that applies in the 
particular circuit should be directed to the CDC. 


C) (U/FECOrA juvenile may be questioned concerning the guilt of a third party if such 
questioning docs not cause any delay in bringing him/her before the magistrate. 


D) (UVEQUO) These special requirements apply only after the arrest of a juvenile, as defined by 
federal law. a federal offense. They do not apply when the juvenile is under arrest by state 
or local officers on a state or local charge but is suspected of having committed a federal 
offense. FBI employees may question a juvenile in custody on a non-federal charge about a 
federal offense for which he/she is a suspect. FBI employees are cautioned, however. that they 
may not collude or create the appearance of collusion with non-federal officers to delay an 
arrest on federal charges to circumvent the JDA requirements. 
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E) (UFF@6) A juvenile may waive his Fifth Amendment rights and consent to a post-arrest 
custodial interview if permitted by the law of the circuit. Whether a waiver is knowing and 
voluntary will be determined based on the totality of the circumstances surrounding the 
interview. Among the factors the court will likely consider are the juvenile’s age, experience, 
education, background, and intelligence. and whether he/she has the capacity to understand the 
warnings given, the nature of Fifth Amendment rights, and the consequences of waiving them. 
The presence and co-signature of a parent or guardian during the waiver of rights (FD-395) is 
not required for a voluntary waiver, although it is a factor to be considered and might help 
dispel any notion that the juvenile was coerced. The AUSA must approve a post-arrest 
custodial interview of a juvenile. 


18.5.6.4.15 (U) DOCUMENTATION 


(U/ROYO) When it is anticipated that the results of an intervi 
court testimony. the interview must be recorded on an FD-302 

ee DIOG subsection 18.5.6.4.15.1 below for guidance on the use of the FD-302. The 
FD-302 must contain a record of statements made by the interviewee and not contain the 
interviewer's opinion or contextual comments. If thei jewer’s opinions or contextual 
comments are relevant. they must be documented tebe other appropriate document. 


If the interviewee characterizes an individual, group, or activity in a certain way, FBI records 
{i.c., 302s, ECs, LHMs) should reflect that the interviewee. not the FBI, is the source of the 
characterization. 


(U/F9@¥0) Certain types of written material developed during the course of an interview 
must be retained including: 


A) (U//FOWO) Written statements signed by the witness. When possible. written statements 
should be taken in all investigations in which a confession or admission of guilt is obtained 
unless the confession is obtained during an electronically-recorded interview session. If a 
witness gives a signed statement, and then gives additional information rs both the signed 


statement and the oral information should be recorded on an FD-302 or 


B) (U/FORO) Written statements, unsigned by the witness, but approved or adopted in any 
manner by the witness. An example of such a written statement would be a written statement 
that the subject orally admits is true but will not sign; and 


C) (UAFEYO) Original notes of an interview when the results may become the subject of court 
testimony. Materials generated via email, text messages, or similar means during an online 
interview must be retained as original notes. Because some forms of synchronous 
communication tools, such as text messaging, have limited or no storage. print, or production 
capabilities, they should not be used for substantive communications with law enforcement 
colleagues or civilians who may become witnesses. If these tools are, nonetheless, used for 
substantive communications as part of an interview, the communications must be 
memorialized verbatim in an FD-302. 


D) (U//F@¥Q) If an FBI employee and an AUSA conduct an interview, and the AUSA asks or 
tells the FBI employee to refrain from recording the substance of the interview or taking notes. 
the FBI employee should decline to participate in the interview and should not be present 
when it takes place unless the interview is part of the trial preparation of the witness (or unless 
another law enforcement agent present is given the responsibility for taking notes and 
documenting the substance of the interview). FBI employees generally do not report the 
substance of trial preparation unless new material information or impeachment information is 
developed. FBI employees should consult with the trial AUSA to determine how to document 
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any new information. including impeaching information, developed during the trial 
preparation interviews. 


E) (U b7E 


(U) See also DIOG Section 3.3.1.14 (Retain Original Notes Made During An Investigation). 


(U/FOYS) All original handwritten interview notes must be retained as "original note 
material" nn e a file. The original handwritten notes may be scanned, but the 
physical original handwritten notes must be retained regardless of whether or not the notes are 
scanned. Also sec 


18.5.6.4.16 (U) USE OF THE FD-302 


(U) Documenting Information of Record: Any matter that may be testimonial must be 
documented using an FD-302 within 


(U) Whenever a person being interviewed could be called upon to testify at any time in a 
future trial, or hearing. the results of the interview must be reported in an FD-302. 


U) All FBI employces present during an ae | 
must be identified by name on the FD-302. 


The employee preparing the FD-302 is listed as the author of the document and all other 
employees present must be listed as co-authors. The author and co-author(s) of the FD-302 


must review the FD-302. and then clectronically sign the final ee ee attest it is 


b7E 


accurate and complete. If someone other than an FBI employee and co-author(s) are 
during the interview. 


resent 


e third party’s presence during all or part of the interview must 


be noted in the FD-302. 


(U) The FD-302 opening paragraph must state the official identity of the interviewing 
agent(s), the purpose of the interview, and the identity of the individual being interviewed to 
include relevant identifying information such as a date of birth, address, or other identifying 
data. It is also permissible to place more details or extensive personal. biographical, criminal 
history, business related information, other agency record information, etc in the body or at 
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the end of the report. When an ongoing interview is carried oul over a period of days, the 
dates should also be set out in the details of the FD-302. In such cases. the report should 
clearly delineate the particular date(s) the information was obtained. A composite interview 
report may be utilized in certain circumstances (sce “composite FD-302” below for additional 
guidance). 


(U) If during an interview, the interviewee provides unrelated information relevant to other 
criminal. national security. intelligence, or public safety matters from the original purpose of 
the interview, the interviewer may take the information. When documenting such unrelated 
information. cach topic must be documented in a separate FD-302. filed to the appropriate 
investigative classification. and disseminated as appropriate. 


U) The preparation of the FD-302 must be initiated as soon as practicable| = 
following the conclusion of the interview or other activity that may be 
esumontal. 


(U) Interview notes must be retained in accordance with DIOG subscctions 3.3.1.14 and 
18.5.6.4.15 above. 


(U) Composite FD-302: In limited situations involving an extended or a series of related 
interviews of a subject. witness. or victim, the preparation of a composite FD-302 may be 
necessary. Preparation of a composite FD-302 at the conclusion of the interview may be the 
most logical and orderly way in which to document the totality of the interview. In these 
situations, in the judgment of the interviewer. a single composite FD-302 might be appropriate 
when: 


(U) 


(U) If agents elect to prepare a composite FD-302, they must, without exception, ensure the 
composite FD-302 captures all material information in the extended interviews. including that 
which may also be considered exculpatory or impeaching. This includes. but is not limited to, 
any materially inconsistent statements of the witness and anything that may tend to mitigate 
guilt or punishment of the accused. 


U) The preparation of the composite FD-302 must be initiated as soon as practicable] | 
following the conclusion of the last interview. 
{U} Interview notes must be retained in accordance with DIOG subsections 3.3.1.14 and 


18.5.6.4.15. 
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(U) Adoption of an FD-302: In consultation with the assigned AUSA or DOJ attorney, the 
agent may seck to have the interviewee adopt an FD-302 as the statement he/she intended to 
give. Adoption by the witness may be in the form of (1) a signed statement. (2) an unsigned 
statement adopted by oral declaration. or (3) the report of information furnished by the 
witness, the substance of which was reviewed fully with the witness and adopted by the 
interviewee as the full and correct report of the statement he/she desired to furnish. Should the 
witness adopt an FD-302 as their statement. the agent must have the witness declare that it 
represents a full and correct report of their statement and then sign and date the first page of 
the FD-302. including any corrections, edits or additions he/she make on that page. The 
witness should also initial and date each subsequent page of the report and also make any 
corrections, edits or additions to the FD-302. The adoption of the FD-302 by the witness can 
provide a defense to any allegations that the FD-302 represents information the interviewer 


claims the witness said, rather than what the witness actually stated. The original b7E 
L — [Poo adopted by the witness should be retained in fof the 
investigative file after it has been scanned and electronically placed into the relevant 


investigative file(s). 


18.5.6.4.17 (U) ELECTRONIC RECORDING OF INTERVIEWS 
18.5.6.4.17.1 (U) OVERVIEW 
U 


U/FE8O) 


b7E 


Uh 


U/FOE8O) 


18-36 


UNCLASSIFIED — FO@R-GFFIGCHEHSEONEE Version Dated: 
March 3, 2016 


UNCLASSIFIED —FOR- OFFICIAL CSE GONET 
Domestic Investigations and Operations Guide §18 


18.5.6.4.17.2 {U} RECORDED NON-CUSTODIAL INTERVIEWS 
18.5.6.4.17.2.1 (U) OVERTLY RECORDED NON-CUSTODIAL INTERVIEWS 


(UHFOUG}FBI employees have the option to conduct an overtly recorded non-custodial 

interview. An overtly recorded interview occurs when an FBI employee. identified as 

such, advises the interviewee that the interview is or will be recorded, or the interviewee 

is otherwise clearly aware that the interview is in fact being recordedT ] b7E 


D 


(U/F686) The FBI employee must provide notification of Js soon as 
practicable fter completion of an overtly recorded non- 


custodial interview(s). The notification may be in the form of the interview summary FD- 
302 described in DIOG subsection 18.5.6.4.17.2.2 below. 


(U/FOELO) Additionally, prior to conducting the interview, the interviewing employee 
should consider the factors listed below, 


A. (U/7FOtO) Whether the purpose of the interview is to gather evidence for 
prosecution or intelligence for analysis or both; 

B. (U/fFOGOs If prosecution is anticipated, the type and seriousness of the crime, 
including, in particular, whether the crime requires mens rea, or a mental clement, 
such as knowledge or intent to defraud. proof of which would be considerably 
aided by the interviewee’s admissions in his/her own words; 

C. (UFU) Whether the interviewee’s own words and appearance (in video 
recordings) would help rebut any doubt about the meaning. context or 
voluntariness of his/her statement or confession raised by his/her age. mental 
state, educational level, or understanding of the English language; or is otherwise 
expected to be an issue at trial, such as to rebut an insanity defense; or may be of 
value to behavioral analysts; 

D. (UAFOHO} If interviewers anticipate that the interviewee might be untruthful 
during an interview. whether a recording of the false statement would enhance the 
likelihood of charging and convicting the person for making a false statement; 

E. (U/FO0} The sufficiency of other available evidence to prove the charge 
beyond a reasonable doubt; 

F. (U/AFQUQ) The preference of the USAO and the Federal District Court regarding 
recorded interviews or confessions; 

G. (U/H#O86) Local laws and practice—particularly in task force investigations 
where state prosecution is possible; 

H. (U/AFOO} Whether interviews with other witnesses or subjects in the same or 
related investigations have been electronically recorded; and 

I. (U7FOUS) The potential to enlist the witness or subject’s cooperation and the 
valuc of using his/her own words to clicit his/her cooperation. 
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18.5.6.4.17.2.2 (U) OVERTLY RECORDED NON-CUSTODIAL INTERVIEW: DOCUMENTATION 
AND HANDLING 


(U/APFOUO) After completing the recorded interview, the FB] employee must document 
the fact that the interview took place in an FD-302| 


(U/POGO} Any handwritten notes taken during the recorded interview must be retained 
as original note material. See also DIOG Section 3.3.1.14 (“Retain Original Notes during 
an Investigation”) 


18.5.6.4.17.2.3 (U) SURREPTITIOUSLY RECORDED NON-CUSTODIAL INTERVIEWS 


(U/FOYO) 


18-38 


UNCLASSIFIED -FOR-GFFIGHAE TSE COREY Version Dated: 
March 3, 2016 


b7E 


UNCLASSIFIED - FOR OFFICIAL ESE-ONLY 
Domestic Investigations and Operations Guide §18 


b7E 


18.5.6.4.17.2.4 (U) SURREPTITIOUSLY RECORDED NON-CUSTODIAL INTERVIEW: 
DOCUMENTATION AND HANDLING 


UFOO] 


U/#OUO 


E 


(U//FERO) Any handwritten notes taken during the recorded interview must be retained 
as original note material. See also DIOG Section 3.3.1.14 (“Retain Original Notes during 
an Investigation”) 


18.5.6.4.17.3 (U) CUSTODIAL RECORDED INTERVIEWS (WARRANT/PROBABLE 
CAUSE) 
18.5.6.4.17.3.1 (U) OVERVIEW 
(U//FOUS) There is a presumption that statements made by persons in FBI custody must 


be recorded following arrest and prior to initial appearance when the arrestee is in a place 
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of detention with suitable recording equipment. All statements made during a custodial 

interview of persons arrested by the FBI for federal crimes.” prior to initial appearance 

and while in a place of detention with suitable recording equipment, must be 

electronically recorded (with very limited exceptions as listed in DIOG subsection 

18.5.6.4.17.4. below b7E 


or factors bearing on 
voluntariness, see DIOG subsection 18.5.6.3. For factors bearing on Miranda compliance. 
see DIOG subsection 18.5.6.4.1.1 


Us Employees must use suitable equipment as a 


Ut 


(UAFO8O) 


18.5.6.4.17.3.2 (U) OVERTLY RECORDED CUSTODIAL INTERVIEWS 


(U//FOUO}y FBI employees may conduct an overtly recorded custodial interview. An 
overtly recorded custodial interview occurs when an FBI employee. identified as such, 


%7 This policy does not apply to a person arrested for a state or local crime during a joint or Task Force investigation. 
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advises the interviewee that the interview is or will be recorded, or the interviewee is 


otherwise clearly aware that the interview is in fact being recorded, b7E 


18.5.6.4.17.3.3. (U) OVERTLY RECORDED CUSTODIAL INTERVIEW: DOCUMENTATION AND 
HANDLING 


(U//BOUO) After completing the recorded į 
that the interview took place in an FD-302. 


(U) The FBI will provide clectronic copies for distribution pre-indictment. Post- 
indictment, the USAO will pay for transcripts of recordings as necessary. 


(UROUS) Any handwritten notes taken during the recorded interview must be retained 
as original note material. See DIOG Section 3.3.1.14 (‘Retain Original Notes during 
Investigation”). 


(U/) 


18.5.6.4.17.3.4 (U) SURREPTITIOUSLY RECORDED CUSTODIAL INTERVIEWS 


(UAFEUCTFBI employees may conduct a surreptitiously recorded custodial interview, 
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BIE 


18.5.6.4.17.3.5 (U) SURREPTITIOUSLY RECORDED CUSTODIAL INTERVIEW: 


DOCUMENTATION AND HANDLING 


(U/AFEUO} After completing the recorded interview. the agent must document the fact 
that the interview took place in an FD-302 


(U) The FBI will provide electronic copies for distribution pre-indictment. Post- 
indictment, the USAO will pay for transcripts of recordings as necessary. 
(U/PO@08) Any handwritten notes taken during the recorded interview must be retained 


as original note material. See DIOG Section 3.3.1.14 (“Retain Original Notes during 
Investigation”). 


(U/FOBOS 


18.5.6.4.17.4 (U) EXCEPTIONS TO MANDATORY RECORDING OF POST-ARREST 
CUSTODIAL INTERVIEWS. 


(U/FO86+Unless are cea to prior written ap 


roval, the interviewin: 
employee must document in as soon as practicable] a] 
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Jarier the completion of the interview. the exercise of an exception to the mandated 
requirement to record a custodial post-arrest interview, must be captioned, 


specifically address the reason(s) why the interview was not recorded 
Upon fpproval] fust be electronically 


placed into the substantive investigative case file. and a notification copy sent to the 
FBIHQ operational unit with program responsibility over the investigative classification. 
appropriate OGC/ILU or NLSB Unit, and to the Division’s Compliance Officer. For 


tracking purposes and for a periodic review b DOJ] [must be electronically placed 
into mee A copy o: locumenting the basis for utilizing an 


exception to the mandatory recording of post-arrest custodial recorded interview policy 
must be made available to the AUSA by the “office of origin” field office overseeing the 
investigation. 

A. (U/IFOBO) Refusal of subject to be recorded during the interview: If the subject is 
advised that the interview will be recorded and they indicate that they are willing to 
provide a statement but wish not to be recorded, then the recording need not take place. 


B. (U/FOCO} Public Safety Exception: If the questioning is reasonably prompted by an 
immediate concern for the safety of the public or the arresting agent under New York v. 
Quarles then recording is not mandatory (sce, c.g. DIOG 18.5.6.4.1.3). 

C. (U/FOBO) 


a. (U/FOBO) 
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c. (U/HFOUQ) 
d. (U/FOUS: 
b7E 
ii. bIE 
iii. bIE 
iv. bIE 
bIE 
yi. bIE 
ec. (U// ‘This is not meant to be an exhaustive list and other considerations 
b7E 


may counsel in favor o 


D. (U//EQU* Recording is not reasonably practicable: In the event that the circumstances 
of the arrest does not allow for the recording of the interview 
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E. (U#FOUC) “Residual” Exception: The 
agree that a significant and articulable law enforcementj BIE 


urpose requires not recording the 


interview. Some considerations may includ 
This exception is to be used judiciously and very infrequently. 
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18.5.6.4.17.5 (U) ELECTRONICALLY RECORDED INTERVIEW REFERENCE 
TABLE 


(U/FECT See below quick reference table regarding electronically recorded interviews: 
b7E 
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18.5.6.4.18 (U) INTERVIEWS RELATING TO CLOSED FILES 


(U//FOBOQ) An interview initiated by an employce should only be conducted if it is within the 
scope of an open authorized Assessment or Predicated Investigation. On the other hand. there 
are situations in which an individual contacts the FBI to report information concerning a 
matter that has been closed or placed in a zero file classification, or is unrelated to any current 
or previous investigation. In these situations, an FB] employee may collect whatever 
information the person is willing to provide. except solely First Amendment information, and 
may document the results of the contact in an FD-7 1/Guardian. or with an EC or FD-302. 
These documents may be electronically placed in files that are relevant to an open Assessment 
or Predicated Investigation, a closed Assessment or Predicated Investigation. a zero 
classification file, or a control file {if no further investigative activity is required). 


(U, b7E 


18.5.6.4.19 (U) FBIHQ OPERATIONAL DIVISION REQUIREMENTS 


b7E 


B) (U/F@8O) Qrher FBIHO Divisions: Each FBIHQ division may provide additional interview 
notice requirements in its PG. 


18.5.6.5 (U) USE/DISSEMINATION 


(U/IFOUO) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 


18.5.6.6 (U/FE BO) OVERSEAS INTERVIEWS 
18.5.6.6.1 (U//FO@E@) INTERVIEWS OUTSIDE THE UNITED STATES 
(UFOS) IL is the policy of the FBI that an employee b7E 


38 The term “FBI employee” includes, but is not limited to, an operational/administrative professional staff 
person, intelligence analyst, special agent, task force officer (TFO}, task force member (TFM), task force 
participant (TFP}, detailee, and FBI contractor. 
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umos o ë ëě 


b7E 
o 
18.5.6.6.2 (U//FOU®O) MIRANDA WARNINGS FOR PERSONS IN CUSTODY OVERSEAS 
U/FEtE 
b7E 
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18.5.7 (U) INVESTIGATIVE METHOD: INFORMATION VOLUNTARILY PROVIDED BY 
GOVERNMENTAL OR PRIVATE ENTITIES 


(U) See AGG-Dom. Part ILA.4.g. 
18.5.7.1 (U) SCOPE 


(U//F@¢O) An FBI employce may accept information voluntarily provided by federal. state, 
local, tribal, or foreign governmental or private entities and individuals. Voluntarily provided 
information includes, but is not limited to, oral as well as documentary and physical evidence 
such as a computer hard drive or other electronic media that contains information, paper 
documents containing information, or physical objects (c.g., handgun or narcotics). 
(U//EQUO) Nothing in this section prohibits asking for or accepting volunteered access to 
personal or real property. 

(U//FOE86) Note: Consent Searches are authorized in Assessments, as well as Predicated 
Investigations. 


(UFOO Note: If the originator of information reported to the FBI characterizes an 
individual, group. or activity in a certain way, and that characterization should be documented 
for completeness of the FBI record, the FBI record (i.c., 302, EC, LHM) should reflect that 
another party, and not the FBI, is the originator of the characterization. 


18.5.7.2 (U) APPLICATION 
(Ui 


18.5.7.3 (U) APPROVAL 


(U/FOERO} Supervisory approval is not required to accept voluntarily provided information. 
Personnel may not request nor knowingly accept information where disclosure would be 
prohibited by federal law. Sce, c.g.. 18 U.S.C. § 2702 (prohibiting an entity providing 
electronic communications services from divulging certain communications and other 
records, except in certain circumstances). 


18.5.7.4 (U) USE/DISSEMINATION 


(U//FER@) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 
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18.5.8 (U) INVESTIGATIVE METHOD: PHYSICAL SURVEILLANCE (NOT REQUIRING 
A COURT ORDER) 


(U) See AGG-Dom. Part II.A.4.h — “Engage in observation or surveillance not requiring a court 
order.” Note: Consent Searches are authorized in Assessments. 


————————— 
18.5.8.1 (U) SCOPE 


(U/FFOUOC) Physical Surveillance Defined: Physical surveillance is the deliberate 
observation of persons, places, or events. on cither a limited or continuous basis, in areas 
where there is no reasonable expectation of privacy. 


UFOO: 
(Us) 
A) 


B) (UFB) 


C) (UFOHO] 
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18.5.8.2 {U} APPLICATION 
(U/A 


18.5.8.3 {U} APPROVAL 


(U/EOROF During 
time not to exceed 


18.5.8.3.1 (U/FFO@GC} STANDARDS FOR OPENING OR APPROVING PHYSICAL 
SURVEILLANCE DURING AN ASSESSMENT 


ment, physical surveillance may be approved for a period of 
s explained further below. 


(UFOO) During an Assessment. in addition to the standards contained in DIOG Sections 
5.5 and 5.8. the FBI employce and supervisor must consider the following: 


A) (U/FOY6) Whether the physical surveillance is rationally related to the articulated purpose 
and objective of the Assessment; 


B) (USHOQ Whether the physical surveillance is the least intrusive alternative for acquiring 
needed information; 


C) (U//FE@8@) If the physical surveillance is for the purpose of determining a pattern of activity, 
whether there is a logical nexus between the purpose of the Assessment and the pattern of 
activity the employce is seeking to determine; and 


D) (UFO) If being conducted in order to gather positive foreign intelligence, whether the 
surveillance is consistent with the requirement that the FBI employce operate openly and 
consensually with a USPER, to the extent practicable. 


18.5.8.3.2  (U/FOUQ._ =o Assessmewrs 


(U/POBS) In an Ass 


ssment. an FBI employee must use the 


FD-71. Guardian] 


(U/) 
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i  ——————T 
(U/HOERO 
in an FD-71, Guardian, an 


18.5.8.3.4 
(U/ 


18.5.8.3. 


(U/BOLO ) 


objective for its 
documented in 2 


U/FOUO 


18.5.8.3.4.2.1 
(U/FOCS 


EC. or other appropriate form requesting Assistant Special Agent in Cha: 


rge (ASAC 
roval standard, renewable for additional is 


Wl] 


4.1 (U/FOBO) APPROVAL REQUIREMENTS 


Must documen 


he reason ani 


use and be approved by an ASAC. The request and approval must be 
uardian. an EC. or other appropriate 
form and electronically placed into the appropriate investigative file. 


18.5.8.3.4.2 (UHPA o 


(vær > 
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C eee 
4 


18.5.8.3.4.3 (U/FFOTO) 


Us 


(U//FE80) Note: 


18.5.8.3.4.4 (U/AFOBO) COMPLIANCE AND MONITORING 


(U//FO8O) The request and approval documentation for the useofL_ sd 


must be electronically placed into the appropriate investigative file. 
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18.5.8.4 {U} OTHER PHYSICAL SURVEILLANCE 


(U//FOHO} Physical surveillance ci 
resources discussed above {i.c. 
does not require supervisory a 


ees, other than through use of the 
during a Predicated Investigation 


b7E 


8.5.8.5 (U) MAINTAIN A “SURVEILLANCE LOG” DURING PHYSICAL SURVEILLANCE 


(UFB) A surveillance log must generally be maintained for the purpose of documenting 
observations made during the period of physical surveillance. The log is a chronological 
narrative detailing the observations noted during the surveillance. A team member must be 
gned to maintaining the surveillance log. At the end of the shift. each individual must 
initial on the surveillance log the notations of the activities he or she observed. Completed 
physical surveillance logs must be electronically placed in the investigative main file or in the 
FISUR sub-file. if the sub-file has been opened for the investigation. Any original notes must 
be permanently retained in a 1A envelope (FD-340a) in the investigative file. Surveillance 
logs must be concise and factual. When reporting locations, the surveillance log must be as 
specific as possible. Surveillance team members must avoid over-reporting and including 
unnecessary information; logs are subject to discovery in legal proceedings. 


8.5.8.6 (U) USE/DISSEMINATION 


(U//FEE8) The use or dissemination of information obtained by this method must comply 
with the AGG-Dom and DIOG Section 14. 
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18.5.9 (U) INVESTIGATIVE METHOD: GRAND JURY SUBPOENAS — TO PROVIDERS 
OF ELECTRONIC COMMUNICATION SERVICES OR REMOTE COMPUTING 
SERVICES FOR SUBSCRIBER OR CUSTOMER INFORMATION (ONLY IN TYPE I 
& 2 ASSESSMENTS) 


(U) See AGG-Dom, Part II.A.4.i. 
(U) See DIOG Section 18.6.5 for additional information on use of Federal Grand Jury (FGJ) 
subpoenas in Predicated Investigations. 
18.5.9.1 (U) SCOPE 
(U/FOO) During a Type 1 & 2 Assessment. an FBI employee may request from an 
appropriate USAO the issuance of an FGJ subpoena for the limited purpose of obtaining 
subscriber or customer information from providers of electronic communication services or 
remote computing services 
A FGJ subpoena. under this provision, may not be requested for the 
purpose of collecting positive foreign intelligence. 


18.5.9.2 (U) APPLICATION 


18.5.9.3 (U) APPROVAL 
(U/FOGOS In Type 1 & 2 Assessments. subscriber or customer information from a 


of electronic communication services or remote computing services 


may be requested through 
the use ofan subpoena without supervisory approval. An agent requesting an FGJ 
subpoena during an Assessment must advise the Assistant United States Attorney (AUSA), 
who will issue the subpoena, that the FB] is conducting an Assessment. The AUSA must 
determine whether there is sufficient connection between the Assessment and possible 
criminal conduct to warrant issuance of an FGJ subpoena. FGJ subpoenas may not be sought 
during a Type 3. 4. 5. or 6 Assessment. 


18.5.9.3.1 (U) MEMBERS OF THE NEWS MEDIA 


(wie) 


(U) Note: 28 C.F.R. § 50.10(b)(1 Xii) provides guidance on categories of individuals and 
entities not covered under the requirements sct out above. 
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18.5.9.4 {U} GRAND JURY SUBPOENAS TO PROVIDERS OF ELECTRONIC 
COMMUNICATION SERVICES OR REMOTE COMPUTING SERVICES FOR 
SUBSCRIBER OR CUSTOMER INFORMATION (ECPA 18 U.S.C. §2703 


(U/PFOUS) Title 18 U.S.C. Section 2703 governs the disclosure of customer 
communications or records maintained by providers of electronic communication services or 
remote computing services when sought by a government agency through Iegal process. 
Subsection (c)(2) of Section 2703 specifies the types of records that may be obtained by the 
government pursuant to a subpoena. 


Us 


OL 


TT 


OL 


d. (U 


e. (U 


18.5.9.5 (U) RESTRICTIONS ON USE AND DISSEMINATION 


(UPO Because judicial districts vary as to whether subscriber records obtained through 
use of an FGJ subpoena must be handled pursuant to the FGJ secrecy rules as “matters 
occurring before the federal grand jury,” subscriber records obtained pursuant to an FGJ 
subpoena should be protected as required by the judicial district in which the FGJ subpoena is 
issued. See DIOG Section 18.6.5 for additional guidance. 


(U//PEOGF In addition, in those judicial districts in which subscriber records obtained 
pursuant to an FGJ subpoena are considered to be matters occurring before the grand jury. no 
documentation of the actual subscriber records should be made in the FD-71 or the 


unrestricted portion of the Guardian FD-7 1a. Instead, a copy of the FGJ subpoena and the 
esponsive subscriber records must bd 


T$ 
uardian FD-71al 
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bIE 


(U/FOHO) 


(U//FOUO} The use or dissemination of information obtained by this method must always 
comply with the AGG-Dom, DIOG Scction 14, and the Federal Rules of Criminal Procedure 
(FRPC) Rule 6. FRCP 6(c). which is discussed below in DIOG subsections 18.6.5.11 and 12, 
and controls the release of information obtained as part of the FGJ proceeding. 
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18.6 (U) AUTHORIZED INVESTIGATIVE METHODS IN PRELIMINARY 
INVESTIGATIONS 
(U) See AGG-Dom,. Part II.B and Part V.A.1-10. 
(U) In Preliminary Investigations the authorized methods include the following: 
A) (U) The investigative methods authorized for Asses 
1) (U) Public information. (See Section i$ 


2) (U) Records or information - FBI and DOJ. (See Section 18.5. 


3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section {8 


4) (U) On-line services and resources. (See Section 18.8.4) 


5) (U) CHS use and recruitment. (See Section 


6) (U) Interview or request information from the public or private entities. (See Section 
§) 


7) (U) Information voluntarily provided by governmental or private entities. (See Section 
iD 


8) (U) Physical Surveillance (not requiring a court order). (See Section 


3.8) 
B) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6. 


C) (U) Intercepting the communications of a computer trespasser. (See Section 18.6.2 ) 
D) (U) Closed-circuit television/video surveillance. direction finders. and other monitoring 
devices. (See Section 3) 


E) (U) Administrative subpoenas. (See Section 


F) (U) Grand jury subpoenas. (See Section 


G) (U) National Security Letters. (See Section | 
H) (U) FISA Order for business records. (See Section 


I) (U) Stored wire and electronic communications and transactional records. (See Section 
4 


J) (U) Pen registers and trap/trace devices. (See Section 1§ 


K) (U) Mail covers. (See Section 18.6.1 


L} (U) Polygraph examinations. (See Section 38 


M)(V) Searches that Do Not Require a Warrant or Court Order BIE 


nd Inventory Searches Generally (See Section 18.8. 


N) (U) Undercover operations. (See Section 18.6.13) 


42 (U/ {Fede +The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18.6.8.4.2.3) 
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18.6.1 (U) INVESTIGATIVE METHOD: CONSENSUAL MONITORING OF 
COMMUNICATIONS, INCLUDING ELECTRONIC COMMUNICATIONS 


18.6.1.1 (U) SUMMARY 


(U) Monitoring of wire. oral or electronic communications based on the consent of one party 
to the communication is referred to as consensual monitoring. The consent exception applies 
to the interception of wire. oral. and electronic communications. Consensual monitoring 
requires review by the CDC or the OGC. (AGG-Dom. Part V.A.4) 


18.6.1.2 (U) APPLICATION 
(U, 


(U/FOBE) See A, 
additional guidance. 


18.6.1.3 (U) LEGAL AUTHORITY 


A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 


B) (U) The Wiretap Statute, 18 U.S.C. § 2511-2522 . prohibits the intentional interception and 
use of wire. voice, or electronic communications absent an exception; 


tronie Surveillunice and Sear 


C) (U) The consensual monitoring exceptions, 18 U.S.C. § 2511(2)(c) & (d). require one party to 
the communication to consent to monitoring; and 


D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA). 50 U.S.C. §§ 1801 et seq. 
provides that if a party to the communication has consented to monitoring, a FISA court order 
is not required. 


18.6.1.4 (U) DEFINITION OF INVESTIGATIVE METHOD 


(U) Generally. the Wiretap Statute (also referred to as Title III), 18 U.S.C. §§ 2510-2522. 
prohibits the intentional interception of wire, oral. or electronic communications unless one of 
several exceptions applies. One such exception is based on the consent of a party to the 
communication. Two other statutory exceptions to the general prohibition include 1) the 
warrant or court order exception, and 2) the computer trespasser exception. This section 
discusses the monitoring of communications under the consent exception. 


(U) Consensual monitoring is the monitoring of communications based on the consent of a 
party to the communication. (AGG-Dom, Part VILA.) For purposes of this policy, at least one 
of the parties to the communication must be located. or the interception of the consensual 
communication must occur, within the United States or the United States territories. The 
consensual monitoring of communications is subject to legal review by the CDC or OGC, as 
applicable. (AGG-Dom, Part V.A.4). Consensual monitoring includes the interception of the 
content of communications and typically falls into one of three general categories: 
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A) (U) Wire communications, which include conventional telephone communications or other 
means of transmitting the human voice through cable. wire. radio frequency (RF). voice over 
Internet Protocol (VoIP). or other similar connections; 


B) (U) Oral communications, typically intercepted through the use of devices that monitor and 
record oral conversations (¢.g.. a body transmitter or recorder or a fixed location transmitter or 
recorder used during face-to-face communications in which a person would have a reasonable 
expectation of privacy but for the consent of the other party}; and 


C) (U) Electronic communications, which include any transfer of signs, signals, writing. images, 
sounds, data, or intelligence by a wire, radio, electronic, or optical em or network (¢.g., C- 
mail, instant message, chat sessions, text messaging, non-voice peer-to-peer communications). 
as that term is defined in 18 U.S.C. § 2510(12)(14) and (17), which are intercepted and 
recorded at the time of transmission. The monitoring of clectronic communications based on 
one party consent is sometimes referred to as “consensual computer monitoring,” “Consensual 
computer monitoring” applies to “real time” clectronic surveillance based on consent and docs 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 


(U) Note regarding electronic communications monitoring: Agents sccking to consensually 
monitor electronic communications (specifically, communications to, through, or from a 
computer) must consider whether the party who has consented is a party to all of the 
communications they want to monitor or whether some of the communications involve a 
computer trespasser. as defined by the computer trespasser exception. (See DIOG Section 
18.6.2) The trespasser exception and the consensual monitoring of communications 
exceptions are related. but separate, exceptions to the Wirctap Statute. The owner, operator, 
and authorized users of a protected computer or computer network can consent to the 
monitoring of only those communications they send or receive (i.c.. to which they are a party), 
which typically does not include a trespasser's communications. The trespasser exception 
allows the interception of the communications transmitted to or from the trespasser. 


(U) When applicable. the exceptions to the Wiretap Statute can be used together, permitting 
the interception of the communications of both authorized users and trespassers on the 
protected computer. This is particularly useful when it is difficult to discern the trespasser 
communications from other communications. If it is possible to obtain consent to monitor the 
communications of the authorized users. use of both the consent and trespasser exceptions 
together can mitigate the risk of over or under collection of the trespasser's communications. 


18.6.1.5 (U) STANDARDS AND APPROVAL REQUIREMENTS FOR CONSENSUAL 
MONITORING 


18.6.1.5.1 (U) GENERAL APPROVAL REQUIREMENTS 


(UAFOH6}) Except as provided below. an SSA may approve the consensual monitoring of 
communications if the information likely to be obtained is relevant to an ongoing Predicated 
Investigation. SSA approval, including oral approval pursuant to DIOG subsection 3.4.2.2, is 
documented through the . and is conditioned on the following criteria being met and 
documented on the FD-759 and other supporting documentation: 
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18.6.1.5.1.1 (U) REASONS FOR MONITORING 


(UFOO) The synopsis must include sufficient factual information supporting the need 
for the monitoring. It must provide the relationship between the monitoring and the 
investigative purpose (e.g.. obtain evidence of drug trafficking, public corruption, etc.). 


18.6.1.5.1.2 (U) DOCUMENTED CONSENT OF A PARTY TO THE COMMUNICATION 
TO BE MONITORED 


(UFOO) Consent must be obtained from one of the parties to be monitored, and the 
consent must be documented to the appropriate investigative ELSUR sub-file. Having the 
consent of one of the parties provides an exception to the Title III statute. The 
requirement to obtain and document consent also applies to the monitoring of computer 
communications. See DIOG Section 18.6.1.8 for specific procedures. 


18.6.1,5.1.3 (U) SUBJECT 


(U//FEES) Agents conducting consensual monitoring must not intentionally intercept 
third-partics who are not of interest to the investigation except for unavoidable or 
inadvertent overhears. 


18.6.1.5.1.4 (U) LOCATION OF DEVICE 


(U//FEHO) Consensual monitoring can only be approved if appropriate safeguards are in 
place to ensure that the consenting party remains a party to the communication 
throughout the course of monitoring. For example, if a fixed-location monitoring device 
is being used, the consenting party must be admonished and agree to be present during 
the duration of the monitoring. If practicable, technical means must be used to activate 
monitoring only when the consenting party is present. 


18.6.1.5.1.5 (U) NOTICE OF CONSENSUAL MONITORING TO OTHER FIELD 
OFFICES 
(U/FOEO) If an employee. CHS, or non-confidential third party is operationally tasked 
to conduct consensual monitoring outside the field office’s territory, the FBI employee 
requesting approval to conduct the monitoring must provide notice to the SSA who is 


responsible for the investigative program in the field office where the monitoring will 
occur. This notice must be documented in the aj 


(Uli 


18-61 


Version Dated: 
— EQOR-ORFICIALUSE ONLY 
UNCLASSIFIED March 3, 2016 


bIE 


bIE 


UNCLASSIFIED -FOR-OFFICHAL-USE-ONEY 
Domestic Investigations and Operations Guide §18 


18.6.1.5.1.6 (U) DURATION OF APPROVAL 


(U//FOGO) The request for approval must state the length of time needed for monitoring. 
Unless otherwise warranted, approval may be granted for the duration of the 
investigation, subject to a substantial change of circumstances. If one or more sensitive 
monitoring circumstances are present, DOJ may limit its approval to a shorter duration. 
See DIOG Section 18.6.1.6.3 below. 


18.6.1.5.1.7 (U) LEGAL REVIEW 


(U//FOTO) Prior to conducting consensual monitoring. the CDC or OGC must determine 
that. given the facts of the investigation. the consensual monitoring is legal, This review 
must be documented wil Should an employee seck oral pproval for 
the use of this method, the Tegal review by the CDC or OGC must be accomplished as 


art of the oral request. The orą al and Jegal revic' st be documented in| 
[he soon as practicable, after the oral 


authorization. Although AUSA concurrence is no longer required for consensual 
monitoring. providing notice to the AUSA is encouraged. 


18.6.1.5.1.8 (U) CHANGE OF MONITORING CIRCUMSTANCES 


(UAFOHO) Whenever the monitoring circumstances change substantially, a new FD-759 
must be executed, and the CDC or OGC must be recontacted to obtain new legal review. 
(AGG-Dom,. Part V.A.4.) The following are examples of substantial changes in 
monitoring circumstances which require a new FD-759: a different consenting party, a 
change in the location of a fixed monitoring device. or the addition of a new computer 
system. If any of these or other monitoring circumstances substantially change, the FBI 
employee must immediately contact the CDC or OGC. 


18.6.1.5.1.9 (U) JOINT INVESTIGATIONS 


(U/FEHO} In joint investigations. the policy and procedures for conducting any 
investigative method or investigative activity by employees or CHSs are usually 
governed by FBI policy. Similarly. employees from other agencies who are participating 
in a joint investigation with the FBI are generally governed by their agencies’ policies 
regarding approvals. If, however. the FBI has assumed supervision and oversight of 
another agency’s employee (e.g., a full time JTTF Task Force Officer), then FBI policy 
regarding investigative methods or investigative activity controls. Similarly. if another 
agency has assumed supervision and oversight of a FBI employee. unless otherwise 
delineated by MOU, the other agency’s policy regarding investigative methods or 
investigative activity controls. 


(U/FOUS) Consensual monitoring conducted by a non-confidential party (¢.g.. witness, 
victim, ctc.) will be controlled by the agency that is primarily responsible for the non- 
confidential party. In a joint investigation. the employees should reach an understanding 
as to which agency is responsible for the non-confidential party; that agency’s policies 
will govern approval and documentation requirements for consensual monitoring. 
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18.6.1.6 {U} CONSENSUAL MONITORING SITUATIONS REQUIRING ADDITIONAL 
APPROVAL 


18.6.1.6.1 (U) PARTY LOCATED OUTSIDE THE UNITED STATES 


(U//FOBS) bIE 
Us bTE 
(U/FORO) bIE 


bIE 


See DIOG Section 13. 


18-63 


Version Dated: 
—EGR-OEFFICIAL LUISE ONLY 
UNCLASSIFIED March 3, 2016 


UNCLASSIFIED -FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide §18 


18.6.1.6.2 (U) CONSENT OF MORE THAN ONE PARTY REQUIRED FOR CONSENSUAL 
MONITORING 


(U/APEYO) Pursuant to Attorney General Order No (3594-2015) dated 11/18/2015. the FBI 

may engage in the consensual monitoring of communications in accordance with FBI policy, 

even if it is considered a crime under state, local, territorial, or tribal law that may require all- 
arly consent and do not sanction or provide a law enforcement exception] 


18.6.1.6.3 (U) SENSITIVE MONITORING CIRCUMSTANCE 


(U) Requests to monitor communications when a sensitive monitoring circumstance is 
involved must be approved by the DOJ Criminal Division. or, if the investigation concerns a 
threat to the national security or foreign intelligence collection, by the DOJ NSD. (AGG- 
Dom, Part V.A.4) A “sensitive monitoring circumstance” is defined in the AGG-Dom. Part 
VILO, to include the following: 


A) (U) Investigation of a member of Congress, a federal judge. a member of the Executive 
Branch at Executive Level IV or above. or a person who has served in such capacity within 
the previous two years (Executive Levels I through LV are defined in 5 U.S.C. §§ 5312-5315); 


B) (U) Investigation of the Governor, Licutenant Governor, or Attorney Gencral of any state or 
territory, or a judge or justice of the highest court of any state or territory, concerning an 
offense involving bribery. conflict of interest. or extortion related to the performance of 
official duties; 

C) (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney General has 
requested that the FBI obtain prior approval for the use of consensual monitoring in a specific 
investigation; or 

D) (U) A party to the communication is in the custody of the Bureau of Prisons (BOP) or the 
United States Marshal Service (USMS) or is being or has been afforded protection in the 
Witness Security Program. 


U// 


E) (UA 


for additional information 


F) (UFFOHO}Sce 


regarding consensual monitoring. 
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18.6.1.6.3.1 (U/FFQGO+PROCEDURE FOR OBTAINING DOJ APPROVAL FOR A 
SENSITIVE MONITORING CIRCUMSTANCE: 


(U/; 
18.6.1.6.3.2 (GHF EEO} EMERGENCY REQUESTS INVOLVING SENSITIVE 
MONITORING CIRCUMSTANCES: 
(U, 
A Ji 


(U/FOHO) 


18.6.1.7 (U) DURATION OF APPROVAL 
(U/H 


18.6.1.8 {U} SPECIFIC PROCEDURES 
(U//FOGO) The following procedures apply when obtaining consent. 
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18.6.1.8.1 (U) DOCUMENTING CONSENT TO MONITOR/RECORD 
Ul bIE 


(ufrovel BIE 


18.6.1.8.1.1 (U) CONSENSUAL MONITORING OF COMPUTERS 


bTE 
the or must review the document at Issue to ensure that the implici 
consent is legally sufficient. 
18.6.1.8.2 (U) DOCUMENTING APPROVAL 
(Ui; b7E 
18.6.1.8.3 (U) RETENTION OF CONSENSUALLY MONITORED COMMUNICATIONS 
(U b7E 


18-66 


Version Dated: 
— FOR GFRICIAL USE ONLY 
UNCLASSIFIED March 3, 2016 


UNCLASSIFIED -FOR OFFICE USE-ONLY 
Domestic Investigations and Operations Guide §18 


18.6.1.8.4 (U) MULTIPLE COMMUNICATIONS 


(Ul; RTE 
18.6.1.8.5 (U) INVESTIGATION SPECIFIC APPROVAL 
(U//FEBO) bTE 
18.6.1.9 (U) COMPLIANCE AND MONITORING 
(ULEQOUO) Case agents and supervisors must regularly monitor the use of this method to 
ensure that the continued interception of communications is warranted and lawfully obtained 
by virtuc of consent. express or implied. from a party to the communication. Such monitoring 
must include a review of the investigative file to ensure that consent and authorization forms 
are in the appropriate investigative ELSUR sub-file and properly completed by the requesting 
agent. ELSUR program personnel must review all submitted FD-759s and consent forms (FD- 
472 and FD-1071) to ensure proper approval is documented for the consensual monitoring of 
communications. 
18.6.1.10 (U) EVIDENCE HANDLING 
Ui 57E 
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18.6.2 (U) INVESTIGATIVE METHOD: INTERCEPTING THE COMMUNICATIONS OF 
A COMPUTER TRESPASSER 


18.6.2.1 (U) SUMMARY 


(U) The wire or electronic communications of a computer trespasser to, from, or through a 
protected computer may be intercepted and collected during a Predicated Investigation. Use of 
this method requires SSA approval and review by the CDC or the OGC. (AGG-Dom, Part 
V.A4) 


18.6.2.2 (U) APPLICATION 
UFONE 


18.6.2.3 (U) LEGAL AUTHORITY 


A) (U) The Fourth Amendment to the United States Constitution and case law interpreting the 
same; 


B) (U) The Wiretap Statute, 18 U.S.C. § 2511, prohibits the intentional interception and use of 
wire, oral, or electronic communications absent an exception; 


C) (U) Computer Trespasser Exception. 18 U.S.C. § 251 1(2)(i); and 


D) (U) The Foreign Intelligence Surveillance Act of 1978 (FISA). 50 U.S.C. §§ 1801 ct seq.. 
requires court authorization for “electronic surveillance.” FISA specifically provides, 
however, that the acquisition of computer trespasser communications that would be 
permissible under 18 U.S.C. § 251 1(2){i) are not subject to the FISA court order requirement 
for electronic surveillance of wire communication under section 101(f)(2) of FISA. 50 U.S.C. 
§ 1801(f) (2). 


18.6.2.4 (U) DEFINITION OF THE COMMUNICATIONS OF A COMPUTER TRESPASSER 


(U) Generally, the Wiretap Statute (also referred to as Title III). 18 U.S.C. §§ 2510-2522, 
prohibits the intentional interception of wire. oral, or electronic communications unless one of 
several exceptions applies. One such exception is the interception of a computer trespasscr's 
wire or electronic communications to. through or from a protected computer based on the 
authorization of the owner or operator of that computer. Another statulory exception is based 
on the consent of a party to the communication. This section relates specifically to the 
computer trespasser exception; the policy on consensual recording of computer 
communications can be found at DIOG Section 18.6.1. 


(U) The computer trespasser exception to the Wiretap Statute, 18 U.S.C. § 2511(2){i). permits 
a person acting under color of law to intercept the wire or electronic communications of a 
computer trespasser that are transmitted to, through. or from a protected computer when the 
owner or operator of that computer authorizes the interception. The use of this method docs 
not include retrieving or obtaining records of communications that have been stored on the 
computer or elsewhere after the communication has occurred. 


(U) The statute requires: 
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A) (U) The owner or operator of the protected computer to authorize the interception of the 
trespasser’s communications on the protected computer: 


B) (U) The person acting under color of law to be engaged in a lawful investigation; 


C) (U) The person acting under color of law to have reasonable grounds to believe that the 
contents of the trespassers communications will be relevant to the investigation: and 


D) (U) The interception is limited to the communications transmitted to or from the tresp: 


ser. 
(U) The case agent is responsible for documenting the basis for the conclusion that the person 
who provided authorization to intercept the trespasser’s communications is either the owner 
or operator of the protected computer. The “owner or operator” must have sufficient authority 
over the protected computer/computer network system to authorize access across the entire 
system. This could be a corporate officer. CIO, or system administrator. if the system 
administrator has authority across the entire system. In any instance in which the 
identification of the owner or operator is not plainly evident. the case agent must seek the 
ance of the CDC or the OGC to identify the proper owner or operator. 


(U) A "protected computer.” defined in 18 U.S.C. § 1030(c). has been generally interpreted to 
be any computer or computer network device connected to the Internet. although it also 
includes most computers used by a financial institution or the United States Government 
regardless of whether the computer is connected to the Internet. 


(U) A “computer trespasser” is a person who accesses a protected computer without 
authorization and thus has no reasonable expectation of privacy in any communication 
transmitted to, from, or through the protected computer. The definition of computer trespasser 
does not include a person known by the owner or operator to have exceeded their authority or 
to have an existing contractual relationship with the owner or operator for access to all or part 
of the computer. (18 U.S.C. § 2510(21)) 


(U) The trespasser exception and the consensual monitoring of communications exception are 
related, but separate. exceptions to the Wiretap Statute. The owner. operator, and authorized 
users of a protected computer can consent to the monitoring of only those communications 
they send or receive (i.c., communications to which they are a party), which do not include a 
trespasser's communications. (See DIOG Section 18.6.1) In comparison, under the trespasser 
exception, the owner or operator may only authorize the interception of the communications 
of a trespasser transmitted to, through or from the protected computer. 


(U) When applicable. the computer trespasser and consensual monitoring of communications 
exceptions to the Wiretap Statute can be used together, permitting the interception of 
communications of both authorized users and trespassers on the protected computer. This is 
particularly useful when it is difficult to discern the trespasser communications from other 
communications. If it is possible to obtain consent to monitor the communications of the 
authorized users. using the consent and trespasser exceptions together can mitigate the risk of 
over or under collection of the trespasscr's communications. See DIOG Section 18.6.1 for the 
policy regarding consensual monitoring of computer communications. 
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18.6.2.5 (U/EO@UO) USE AND APPROVAL REQUIREMENTS FOR INTERCEPTING THE 
COMMUNICATIONS OF A COMPUTER TRESPASSER 


18.6.2.5.1 (U) GENERAL APPROVAL REQUIREMENTS 


(U//FO@O) An SSA may approve the use of the computer trespasser exception, subject to 
CDC or OGC review. Approval is conditioned on the following criteria being met and 
documented on the $ 39 and through other supporting documentation in the investigative 
file: 


18.6.2.5.1.1 (U) REASONS FOR THE INTERCEPTION 


(U//FO8O} The synopsis portion of the FD-759 must include sufficient facts to support 
the need for the interception and to explain how the contents of the urespasser's 
communications will be relevant to the investigative purpose. 


18.6.2.5.1.2 (U) OWNER OR OPERATOR AUTHORIZATION 


(UFOO) The authorization of the owner or operator of the protected computer (who 
may be the system administrator. as stated above) to a person acting under color of law to 
intercept the trespasser communications on the protected computer system or network 
must be documented using the FD-1070. Authorization to Intercept the Communications 
of a Computer Trespasser. The steps the case agent takes to ensure that the person 
providing the authorization is the actual or appropriate owner or operator of the protected 
computer must be documented in the investigative file. See 18.6.2.6 below for specific 
procedures. 


18.6.2.5.1.3 (U) ACQUIRING ONLY TRESPASSER COMMUNICATIONS 


(UFO) When intercepting communications under the computer trespasser exception 
alone (i.c.. not in conjunction with consensual monitoring of electronic communications), 
the collection must not intentionally acquire communications other than those to or from 
the trespasser. This can often be technically complicated to accomplish depending on the 
use and configuration of the protected computer and the sophistication of the trespasser. 
The steps to be taken to identify trespasser communications and to isolate such 
communications from those of authorized users must be considered by the approving and 
reviewing officials and documented in the investigative file. See DIOG Section 18.6.2.6 
below for specific procedures. 


18.6.2.5.1.4 (U) OWNER OR OPERATOR COLLECTION 


(U/fFOGO) The interception of trespasser communications may be conducted by the FBI 
or by the owner or operator of the protected computer at the FBI’s request. In either 
instance, the interception is being conducted under color of law. If the collection is not 
being conducted by the FBI, the case agent must document that he or she has informed 
the person conducting the interception that it must be accomplished in conformity with 
the statute. 


18.6.2.5.1.5 (U) LOCATION OF INTERCEPT 


(UAFE8Q} If the intercept or collection of the trespasser communications will occur 
outside of the field office of the approving official. the SAC or ASAC of the field office 
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within which the interception will occur must be notified, and the notification must be 
documented in the investigative file. 


18.6.2.5.1.6 (U) DURATION 


(U#BOUR) The request for approval (FD-759) must state the length of time needed for 
the interception. Unless otherwise warranted. approval may be granted for the duration of 
the investigation. subject to a substantial change of circumstances, as described in DIOG 
Section 18.6.2.6, below. 


18.6.2.5.1.7 (U) LEGAL REVIEW 


(U/APFEYO) Prior to conducting the interception, the CDC or OGC must review the 
request and determine that, given the facts of the investigation. the interception appears to 
be lawful under the computer trespasser exception. Whenever the factors surrounding the 
use of the approved technique change substantially, a new FD-759 must be executed. The 
newly executed FD-759 must include new legal review by the CDC or OGC. (AGG- 
Dom, Part V.A.4.) The following are examples of substantial changes in the 
circumstances of the interception that require a new FD-759: a change in owner or 
operator, a change in the method of collection. or the change or addition of a protected 
computer system. On the other hand. technical changes in the collection system for the 
purpose of improving or refining the interception are usually not substantial changes to 
the circumstances of the interception. 

18.6.2.5.1.8 (U) JOINT INVESTIGATIONS 
(U/AFOVO) In joint investigations. if the FBI is the lead investigating agency. FBI 
policies and guidance regarding the interception of computer trespasser communications 
must be followed. If the FBI is not the lead investigating agency, the policies of the Iead 
investigating agency must be followed and documented to the appropriate FBI 
investigative file. 

18.6.2.5.1.9 (U) EXTRATERRITORIAL CONSIDERATIONS 

Uh bIE 


18.6.2.6 (U) DURATION OF APPROVAL FOR INTERCEPTING THE COMMUNICATIONS OF A 
COMPUTER TRESPASSER 


(U//FOU@}The interception and collection of computer trespasser communications under the 
computer trespasser exception may be approved for a specified length of time or for the 
duration of the particular investigation. 


18.6.2.7 (U) SPECIFIC PROCEDURES FOR INTERCEPTING THE COMMUNICATIONS OF A 
COMPUTER TRESPASSER 


(UFOO) The following procedures apply when obtaining authorization. 
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18.6.2.7.1 (U) DOCUMENTING AUTHORIZATION TO INTERCEPT 


(U/POUOF Whenever possible. written authorization must be obtained from the owner or 
operator of the protected computer and documented on an FD-1070, Authorization to 
Intercept the Communications of a Computer Trespasser. 


(UFOS) If the authorization from the owncr or operator is provided orally, at least onc FBI 
agent and another law enforcement or intelligence officer should witness the authorization, 
and the authorization must be memorialized in an FD-302. The fact that the authorizing party 
has declined or was unable to give written authorization must also be recorded on the FD- 
1070. Authorization to Intercept the Communications of a Computer Trespasser form. This 
form should then be executed in all respects with the exception of the authorizing party's 
signature. 


(U//FOHO) The case agent must document to the file (i.e., FD-302 or EC) the facts that 
establish that the person providing the authorization is a proper party to provide authorization 
for the anticipated interception. 


(U/EQUO+ If the case agent is seeking approval for the FB] to engage in both consensual 
monitoring and an interception of the computer trespasser on the same computer system, 


18.6.2.7.2 (U) ACQUIRING ONLY THE TRESPASSER COMMUNICATIONS 


(U/@80} The computer trespasser exception permits the FB] to intercept only trespasser 
communications. Prior to secking approval to intercept computer trespasser communications. 
the case agent must coordinate the use of the method with the Field Office Technical Advisor 
by submission of an Electronic Technical Request (ETR). On receipt of the ETR. the 
Technical Advisor must ensure that the technical equipment and expertise necessary to 
lawfully implement the interception are timely provided following approval to use this 
investigative method. 


(U/JFOU) Many of the technical challenges and risks associated with accurately isolating 
the trespasser communications can be mitigated by also obtaining consent to monitor the 
computer or a court order. The possibility of using the authority to intercept trespasser 
communications in conjunction with consent should be raised at the time of the ETR 
submission or as soon thereafter as the case agent determines that the authorized users of the 
protected computer will consent to FBI monitoring. 


(UFOS) When intercepting trespasser communications. the case agent must prepare an 
FD-302 or EC detailing the steps taken to identify trespasser communications and to isolate 
such communications from those of authorized users. For example: "reviewed system logs 
provided by the system administrator and identified a trespasser accessing the system at the 
following dates and times via IP address xxx or port xxx.” Additionally, any subsequent 
review or revision of the steps needed to identify and isolate the trespa: communications 
must also be documented to the investigative file by an EC or FD-302, as appropriate. 
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18.6.2.7.3 (U) REVIEWING THE ACCURACY OF THE INTERCEPTION 


(U//FOVO}-AL the initiation of the interception and collection of computer trespasser 
communications, the Technical Advisor or designated technically trained agent (TTA) 
coordinating the implementation of the interception and collection device shall ensure that 
appropriate collection parameters are implemented as required by OTD policy and 
procedures. 


(U//FERO) The case agent shall ensure a timely initial review of the collected information to 
verify that the interception and collection are limited to communications authorized for 
interception and collection under the trespass authority or other lawful exception. Following 
this initial review, the case agent shall ensure that a similar review and evaluation is repeated 
al appropriate intervals throughout the duration of the interception to ensure that the 
interception and collection remain within the scope of the trespasser or other lawful 
exceptions. Factors that may impact the frequency of reviews include. but are not limited to: 
volume of data to be reviewed, complexity and nature of data collected. and complexity of the 
trespassed system. 

(U/FƏ897 Any FBI employee who identifies interception and collection of communications 
that may be outside the scope of the trespasser or other lawful exception shall immediately 
notify the case agent and the operational SSA of the possible unauthorized interception and 
collection of communications. Upon the determination that communications have been 
unlawfully intercepted or collected, the interceptions and collection must be halted 
immediately. The case agent must consult with a TTA to determine whether collection may be 
resumed in a manner that assures further unlawful collections will not occur. If the SSA 
determines that unlawful collection can be reliably prevented, that determination must be 
documented to the file before lawful interceptions and collection may resume. 


(U/FOtOY The content of communications determined to have been unlawfully collected 
cannot be used in any manner and shall be removed promptly [rom all FBI systems and 
destroyed. A memorandum documenting the removal and destruction shall be filed in the 
main investigation file and the appropriate investigative ELSUR sub-file. 


18.6.2.7.4 (U) REVIEWING THE RELEVANCY OF THE INTERCEPTION 


(U/JFOUS} The trespasser exception requires the FB] to have a reasonable belief that the 
contents of the trespasser’s communications will be relevant to the investigation. Following 
the initiation of the interception and collection of the trespasser communication, the case 
agent must ensure that the collected communications are reviewed, at appropriate intervals 
throughout the duration of the interception, to determine whether the interception is and 
continues to be relevant to the authorized investigation. Factors that may impact the frequency 
of reviews include, but are not limited to: volume of data to be reviewed, complexity and 
nature of data collected, and complexity of the trespassed system. 


18.6.2.7.5 (U) DURATION OF APPROVAL 


(U//F@O} Authorization to intercept trespasser communications remains valid until such 
lime as the authorizing party. orally or in writing, revokes the authorization or on the 
termination date of the authorization, whichever comes first. 
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18.6.2.7.6 (U) ELSUR REQUIREMENTS 


(UAFOEO) The information obtained from the collection must be retained in conformity with 
the ELSUR Policies located in the OGC Main Law Library) or other applicable policies. 


(UAPEHO) All ELSUR downloading, processing, and handling of original. derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfully completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded into 


LJV Multiple Communications. 


(U/FO8®) In investigations in which various modes of communication may be intercepted 
(c.g., telephonic, non-telephonic, electronic communications. cte., or the use of consensual 
computer monitoring in conjunction with the interception of trespasser communications), onc 
FD-759 may be used to document approval, provided that each mode of communication to be 
monitored is being used in the same investigative file and all facts required on the FD-759 are 
the same. If the material facts on the FD-759 vary (c.g.. different periods of authority, ctc.). 
separate FD-759s must be executed. 


18.6.2.7.7 (U) INVESTIGATION SPECIFIC APPROVAL 


(UABOUO; Approval for intercepting a computer trespasser's communications is 
investigation specific and is not transferable to any other investigation, unless the 
investigative file under which the authority was granted is consolidated or reclassified. 
Investigation specific approval must be obtained for any spin-off investigation(s) that arises 
out of the original investigation. 


18.6.2.8 (U) COMPLIANCE AND MONITORING 


(U#FOHO Case agents must regularly monitor the use of this method to ensure that the 
continued interception of trespasser communications is warranted and being lawfully 
conducted. Such monitoring shall include a review of the investigative file to ensure that 
consent and authorization forms have been properly executed and filed. ELSUR program 
personnel must review all submitted FD-759s and FD-1070 (Authorization to Intercept the 
Communications of a Computer Trespasser form) to ensure proper approval has been 
documented for the interception of computer trespasser communications. 


18.6.2.9 (U) EVIDENCE HANDLING 


(UFOS) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfully, ed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded P | 
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18.6.3 (UFOO) InvesricaTIve MerHOoD:| __ Ž — ] 


(_] CLosep-Circutr TELEVISION/VIDEO SURVEILLANCE, 
DIRECTION FINDERS, AND OTHER MONITORING DEVICES 


18.6.3.1 (U) SUMMARY 
(Uh BIE 
(U b7E 
Us bIE 
bIE 


18.6.3.2 (U) APPLICATION 


U. 
not otherwise prohibited by AGG-Dom, Part III.B.2-3 


18.6.3.3 (U) LEGAL AUTHORITY 


A) (U) AGG-Dom, Part V 

B) (U) Rule 41 Federal Rules of Criminal Procedure 

C) (U) Fourth Amendment to the United States Constitution 
18.6.3.4 (U) DEFINITION OF INVESTIGATIVE METHOD 


A) (U/FO86FClosed Circuit Television/Video Surveillance (CCT V/Video Surveillance): a 
fixed-location video camera/device that is typically concealed from view or that is placed on 


or operated by a consenting party. 


(UTFOUS} Electronic Tracking Devices: See 


B) 
and also OTD’s 
p 
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18.6.3.5 (UAFOGOSSTANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR 
INVESTIGATIVE METHOD 


(U/FOBO} When a video camera is physically operated as a hand-held video and is used in 
an area in which no onc has a reasonable expectation of privacy, its use is equivalent to using 
a still camera and does not require CDC review or SSA approval. 


(U//POOS Except for a hand-held video as described above, CDC or OGC review and SSA 
approval is required for the use of CCT V/Video Surveillance. CDC review and SSA approval 
must be documented using the FD-759. SSA approval may be granted if the following criteria 
have been met: 


A) (UPFOUSs Legal review from the CDC or OGC that a court order is not required for 
installation or use of the device because there has been lawful consent, no reasonable 
expectation of privacy exists, or no physical trespass is necessary to install the device. 
Whenever circumstances change in either installation or monitoring, a new legal review must 
be obtained to determine whether a separate authorization is necessary; 


B) (U/FOUG+ Use of the method is reasonably likely to achieve investigative objectives; 
C) (UA 


18.6.3.6 (U) DURATION OF APPROVAL 
(Us) 


18.6.3.7 (U) SPECIFIC PROCEDURES 


(U/FOEO+To usc this method. the case agent must: 
A) (U//H 


B) (U#F 
C) (UA 
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18.6.3.8 (U) CCT V/VIDEO SURVEILLANCE WHERE THERE IS A REASONABLE 
EXPECTATION OF PRIVACY IN THE AREA TO BE VIEWED OR FOR THE 
INSTALLATION OF THE EQUIPMENT. 
18.6.3.8.1 (U) WARRANT OR COURT ORDER 


(U/AFOU6) A warrant/court order is required for the use of CCT V/Video Surveillance when a 
reasonable expectation of privacy cxists in cither the arca to be viewed or the location where 
the equipment will be installed. unless the installation and monitoring is being conducted 
pursuant to consent. See DIOG Section 18.6.3.8.2 below for the required consultation with the 
Technical Advisor (TA) or technically Trained Agent (TTA). 


A) (UFO Criminal Inyestigations: When there is a reasonable expectation of privacy in the 
arca to be viewed and no consenting party. prior DOJ/OEO approval is required before 
seeking a warran/order. When there is a reasonable expectation of privacy only in the location 
where the CCTV/Video Surveillance equipment will be installed. but not in the area to be 
viewed, prior DOJ/OEO authorization is not required to seck a warranVorder for the 
installation. In an emergency situation where CCTV usage is desired and a warrant/court order 
would be required, but cannot be obtained within the time required. an AUSA must be 
contacted to seck DOJ/OEO’s guidance on how to proceed 


B) (UFOS) National Security Investigations: The use of CCT V/Video Surveillance in 
national sccurity investigations under the Forcign Intelligence Surveillance Act of 1978 
(FISA) requires the filing of an appropriate FISA court order because the use of CCT V/Video 
Surveillance falls within the definition of “electronic surveillance” under FISA. See DIOG 
Section 18.7.3. 


©) (UFOO Where a warrant is required and the request is included with a Title HI or is a 
FISA request: Where the CCT V/video surveillance request is made pursuant to FISA or in 
conjunction with a Title II request. the required supervisory approvals and CDC or OGC 
review will take place as part of the larger FISA or Title ILI review and approval process. No 
additional reviews or approvals for the CCTV/video surveillance are required. 


D) (UAFOUO) Where a warrant is required and the request is NOT coupled with a Title HI 
request or made pursuant to FISA: As the FD-759 is not used when a court order is needed. 
the required SSA approval and CDC or OGC review must be documented in an EC. Maintain 
the original SAC approved EC in the appropriate investigative ELSUR sub-file. 


18.6.3.8.2 (U/FO-GO) REQUIRED CONSULTATION WITH TECHNICAL ADVISOR (TA) 
OR TECHNICALLY TRAINED AGENT (TTA) 
(U/POGOF Prior to filing an application and affidavit for a warrant/court order under Rule 
41/All Writs Act (in criminal law-based investigations) or under FISA (in national security- 
based investigations), the case agent/special agent must consult with the field office TA/TTA 
to: 
A) (UPFEU6}<onsider any potential technical issues; and 


B) (U/FOU@}review any “technical” or “technique” language uscd in the application and 
affidavit. 


18-77 


Version Dated: 


UNCLASSIFIED —EQR-OBRFICHAEGSEONEY March 3,2016 


BIE 


UNCLASSIFIED —FOR- OFFICIAL HSE CNET 
Domestic Investigations and Operations Guide §18 


(U/FEUGQ} This review ensures that the language used therein is accurate and does not 
disclose classified/sensitive methods and techniques. 

18.6.3.9 {U} EVIDENCE HANDLING 
(U/FOS) All ELSUR downloading, processing, and handling of original, derivative, and 
copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 


technician (EOT) or other designated employee (e.g. an agent who has successfully completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded in| 


18.63.10 ©L____] 


(Us) 


18.6.3.11  (U) CCT V/VIDEO SURVEILLANCE EQUIPMENT — TYPES, AVAILABILITY, 
REPAIR AND DISPOSAL 


18.6.3.11.1 (U) EQUIPMENT TYPES 


(U/FOUC} Listed below are categories of CCT V/Video Surveillance equipment and related 
methods. Since CCTV/Video Surveillance tools change with some frequency, available 
equipment and methods can be accessed via the appropriate hyperlink to the VSU Web page. 


E J] 


(U) See VSU 


C) usreg _ | 


{U} See 


18631111 movo —  ěž ] 
ie EERE o n n inpoven unclassified s 


stem that supports FBI special 
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18.6.3.11.2 (U) EQUIPMENT AVAILABILITY 


(UPFEYO) If CCTV/Video Surveillance equipment is not available from the existing field 
office inventory, the TA/TTA must use the Technical Management Database (TMD) to 
forward requests to the appropriate VSU program manager (PM). 


18.6.3.11.2.1 (U0) SURVEY SHEET 
(U#FOYO) The TA or TTA should contact the case agenVspecial agent requesting the 
CCTV/video surveillance to determine his/her objective and expectations of the 
CCTV/Vidco Surveillance. eee | designed to capture the 
information needed to maximize investigative and technical success when using 
CCTVW/Video Surveillance equipment. 
18.6.3.11.3 (U) EQUIPMENT REPAIR 


(UAFOUS) Field office TAs/TTAs must consult with the appropriate VSU PM and obtain 
approval prior to sending any CCTV/Vidco Surveillance equipment to VSU for repairs. 


18.6.3.11.4 (U) EQUIPMENT DISPOSAL 
(U//FQUQ} Ficld office TAs/TTAs must determine the appropriate disposition of non- 


repairable equipment. Surplus property will be disposed of by field offices for equipment 
under its cost code. 


18.6.3.12 (U) COMPLIANCE AND MONITORING 


(U/FOCO) Authorization documents regarding the use of the CCT V/Vidco must be 
documented in the appropriate investigative ELSUR sub-file and will be available for 
compliance and monitoring review. See this Section and DIOG Section 18.6.1.9 (consensual 
CCTV/video surveillance use) for the requirements for using CCT V/Video Surveillance. See 
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18.6.4 (U) INVESTIGATIVE METHOD: ADMINISTRATIVE SUBPOENAS 
(COMPULSORY PROCESS) 


18.6.4.1 (U) OVERVIEW OF COMPLLSORY PROCESS 
(UTFORO 


(U) 


18.6.4.2 (U) APPLICATION 
/ 


18.6.4.3 (U) ADMINISTRATIVE SUBPOENAS 
18.6.4.3.1 (U) SUMMARY 


(U) The Attorney General has the authority to issue administrative subpoenas pursuant to two 
provisions of the United States Code. 21 U.S.C. § 876 and 18 U.S.C. § 3486. The FBI has no 
inherent authority to issue administrative subpoenas but has delegated authority from the 
Attorney Gencral to do so. The use of administrative subpoenas is limited to three categories 
of investigations—drug program investigations, child scxual exploitation and abuse 
investigations, and health care fraud investigations—and may not be used for any other 
purpose. The delegated authority varies depending on the federal violation being investigated. 
The type of information that can be obtained using an administrative subpoena is also limited 
by law and by policy of the Attorney General. 


(U#FOUO) Within the FBI. the authority to issue administrative subpoenas is limited to 
sitions authorized by the Attorney General; that authority may not be further redelegated. 
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18.6.4.3.2 (U) LEGAL AUTHORITY AND DELEGATION 


18.6.4.3.2.1 (U) INVESTIGATIONS INVOLVING THE SALE, TRANSFER, 
MANUFACTURE OR IMPORTATION OF UNLAWFUL DRUGS 


(U) Authority: 21 U.S.C. § 876 and DOJ Regulation at 28 C.F.R. App to Pt. 0, Subpt. R § 
4. 


(U) May be issued to: Any individual or business holding records relevant to the drug 
investigation. 


(U) Records to be obtained: Any records relevant or material to the investigation. 


(UAFOUO) Delegated authority to issue: By DOJ regulation, the Attorney General ’s 
delegation includes SACs, ASACs, SSRAs and “those FBI Special Agent Squad 
Supervisors who have management responsibilities over Organized Crime/Drug Program 
investigations.” 


U/OUO) Multi-offense investigations; bIE 


(U//FOUO) Confidentiality: bIE 


18.6.4.3.2.2 (U) INVESTIGATIONS INVOLVING THE SEXUAL EXPLOITATION OR 
ABUSE OF CHILDREN 


(U) Authority: 18 U.S.C. § 3486(a) and Attorney General Order 3220-2010. 


(U) May be issued to: A “provider of an electronic communication service” or a “remote 
computer service” (both terms defined below in DIOG Section 18.6.4.3.4.2.1) and only 
for the production of basic subscriber or customer information. The subpoena may 
require production as soon as possible but in no event less than 24 hours after service of 
the subpoena. 


(U) Records to be obtained} b7E 
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(U/FOUO) Delegated authority to issue: bIE 


(U/FOUC) Violations to which this authority applies: These administrative subpoenas 
may only be issued in investigations that involve a violation of 18 U.S.C. §§ 1201, 1591. 
2241(c), 2242. 2243, 2251, 2251 A. 2252. 2252A, 2260, 2421. 2422, or 2423 in which the 
victim is less than 18 years old. Under the Attorney General’s delegation, an 
administrative subpoena in these investigations may be issued only to “providers of 
electronic communication services” or to “remote computing services” to obtain the 
information listed above. These administrative subpoenas may not be issued to any other 
person or entity or to obtain any other information, including the content of 
communications 


b7E 


18.6.4.3.2.3 (U) INVESTIGATIONS INVOLVING FEDERAL HEALTH CARE FRAUD 
OFFENSES 


(U) Authority: 18 U.S.C. § 3486(a) 


(U) Records to be obtained: Records relevant to an investigation relating to a “federal 
health care offense.” Federal health care offense is defined in 18 U.S.C. § 24. 


(U) May be issued to: Any public or private entity or individual with records relevant to 
the federal health care offense. (These are referred to in guidance issued by the Attorney 
General as “investigative demands.”) 


(UPPOUOS Delegated authority to issue: The Attorney General has not delegated 
signature authority to the FBI. AG authority is delegated only to personnel within DOJ’s 
Criminal Division and to United States Attorneys, who may redelegate the authority to 
AUSAs. FBI employees must request an AUSA to issuc administrative subpoenas in 
health care fraud investigations. 


(U) Limitations: The Right to Financial Privacy Act (RFPA) limitations described in 
18.6.4.3.4 of this section apply. The provisions in ECPA govern. as discussed in 
18.6.4.3.4 of this section. if the request for records is addressed to a “provider of 
electronic communication service” or a “remote computing service.” The subpoena may 
not require the production of records at a place more than 500 miles from the place the 
subpoena is served. 


18-82 Version Dated: 
UNCLASSIFIED —FGOR- GFFICHEESEONLY March 3, 2016 


UNCLASSIFIED =EOR-OFFICHLUSE CNET 
Domestic Investigations and Operations Guide §18 
b7E 


(U) Restriction on use of health care information against the individual: Pursuant to 18 


U.S.C. § 3486, health information about an individual acquired through an authorized 
investigative demand may not be used in. or disclosed to any person for usc in. any 
administrative, civil, or criminal action against that individual unless the action or 
investigation arises from and is directly related to receipt of health care, payment for 
health care, or a fraudulent claim related to health care. 


18.6.4.3.3 (U) APPROVAL REQUIREMENTS 
18.6.4.3.3.1 (U) REQUIRED FORM 


AY ulin accordance with DIOG subsections 18.6.4.3.2.] and bTE 


ust be prepared and issued using the electronii 

he electronic form is designed to 
is: (1) issued only in investigations where its use is 
permitted; S and information that can be obtained within the applicg 
and policy limitations; and (3) approved by an individual with proper authorit 
eee be electronically placed into the} 

relevant investigative case fr ich jt is issued. An electronic copy 0 
ae be saved in th ata base when it is electronically placed into 


B) (U) Th allows for the gencration of E | b7E 
any need specified in DIOG subsections 18.6.4.3.2.1 and 18.6.43-2.2 above. For 


served to participating providers, it also provides the ability to 
receive expedited returns. as well as a means to review and ingest the retum information 
e | for storage, processing, and analysis. 


C) ee 5 to an electronic communication service bTE 
provider contains an attachment explaining the meaning of various terms used in the 


demand for information 


y 
DOJ SEA without approval from OGC or the CDC. That approval must be documented 


te File. 


18.6.4.3.3.2 (U) APPROVAL AUTHORITY 


(U/FOUCr Use of an administrative subpoena requires SSA approval. The subpoena 
may be issued by the SSA if that SSA is among those with delegated authority to do so. 
Sce DIOG Sections 18.6.4.2.2.1 — 18.6.4.2.2.3 above) Otherwise, the subpoena must be 
forwarded to an individual with the proper delegated authority. Further review and 
approval may be required depending on the delegation. Review by the CDC is 
appropriate if legal questions arise in preparing and issuing the subpoena. 


(Uh; bIE 
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18.6.4.3.3.3 (U) REIMBURSEMENT FOR THE PRODUCTION OF TOLL RECORDS 


A) (U/PFE8O} Reimbursement to a telecommunications provider (electronic communications 
service) for toll, and other records produced, pursuant to the issuance of anj 
is governed by statutory requirements and exceptions to those provisions. 
Additional guidance on toll record reimbursement, specific circumstances that preclude 


reimbursement, and a template telecommunications provider response letter, can be found 
on the Help link within OTD’ fore page. 


B) U/HO867 An individual designated by proper authority to issue an 
mana permitted to sign and issue a “no payment” response Ictter to a provider upon 
determination that an invoice reccived from the telecommunications provider falls within 
the statutory exceptions to reimbursement. Consultation with, and review of the letter by, 
the CDC is appropriate if legal questions arise in preparing and issuing the response letter. 


18.6.4.3.4 (U) LIMITATIONS ON USE OF ADMINISTRATIVE SUBPOENAS 
18.6.4.3.4.1 (U) FINANCIAL PRIVACY LIMITATIONS 
18.6.4.3.4.1.1 (U) OBTAINING RECORDS FROM A FINANCIAL INSTITUTION 


(U#FOUO) “Financial records” are those records that pertain to a customer’s relationship 
with a financial institution. The term “financial institution” is broadly defined as a bank, 
savings bank, card issuer. industrial loan company. trust company, savings association, 
building and loan or homestead association, credit union, or consumer finance institution, 
located in any state, territory. or the District of Columbia. See 12 U.S.C. § 3401. (Note: 
The scope of the RFPA’s definition of financial institution for this purpose, which limits 
the restrictions the RFPA places on federal law enforcement in using an administrative 
subpoena, is narrower than the definition of financial institution that is used in connection 
with NSLs. For that purpose, the RFPA refers to the broader definition found in the Bank 
Secrecy Act (BSA). Among the entities included in the BSA definition are money 
transmitting businesses, car dealers, travel agencics, and persons involved in real estate 
closings. See 12 U.S.C. § 3414(d) and 31 U.S.C. § 5312 (a) (2) and (c) (1).) When 
secking financial records from a financial institution. the FBI must send a certificate of 
compliance required by 12 U.S.C. § 3403 to the financial institution. The certificate must 
indicate. among other things, that notice has been provided by the FBI to the individual 
customer whose financial records are to be obtained. The content of the notice is set out 
in 12 U.S.C. § 3405. A court order may be obtained that allows for delayed notice 
pursuant to 12 U.S.C. § 3409. Notice is not required if the administrative subpoena is 
issued to obtain the financial records of a corporation or for records not pertaining to a 
customer. Notice is also not required if the administrative subpoena seeks only basic 
account information, defined as name. address, type of account. and account number. See 
12 U.S.C. § 3413(g). 


18.6.4.3.4.1.2 (U) OBTAINING RECORDS FROM A CREDIT BUREAU 


(UAFOGO} A credit burcau or consumer reporting agency may only provide name, 
address, former addresses, place of employment and former place of employment in 
response to an administrative subpoena. See 15 U.S.C. § 1681f. A credit bureau or 
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consumer reporting agency may not release financial information in a credit report or 
consumer report, or the names and locations of financial institutions at which the 
consumer has accounts pursuant to an administrative subpoena. A court order, a grand 
jury subpoena, or. in an appropriate investigation, a national security letter may be used 
to obtain this information. 15 U.S.C. § 1681b. Notice of disclosure will be provided by 
the credit bureau or consumer reporting agency to the consumer if the consumer requests 
this information. 


18.6.4.3.4.2 (U) ELECTRONIC COMMUNICATION PRIVACY ACT 


(UPSB) The ability to gather subscriber information and the content of electronic 
communications using an administrative subpoena is governed by ECPA. In 
investigations involving the sexual exploitation or abuse of children, only basic 
subscriber or customer information may be obtained with an administrative subpocna 
under the terms of the Attorney General’s delegation, as described above. No content 
information may be obtained. In drug and health care fraud investigations, an 
administrative subpoena may be used to obtain basic subscriber or customer information 
and certain stored communications, under limited circumstances. from entities that 
provide electronic communication services to the public. 


18.6.4.3.4.2.1 (U) SCOPE 


(U/FOYO) ECPA applies to two types of entities that provide electronic 
communications to the public. They are: 


A) (U/FOYƏ¥ Electronic Communication Service” is defined as “any service that provides the 
user thercof the ability to send or receive wire or electronic communications.” 18 U.S.C. § 
2510(15) 


B) (U/FOHO} “Remote Computing Service” is defined as the “provision to the public of 
computer storage or processing service by means of an electronic communication system,” 18 
U.S.C. § 2711(12) 


18.6.4.3.4.2.2 (U) SUBSCRIBER INFORMATION 
(Us b7E 


A) (Wisp) b7E 
B) UF J b7E 


ous MMN be 


pyuimese o SS>S>öòY wn 
(Ut bIE 
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18.6.4.3.4.2.3 (U) SECOND GENERATION CONNECTION RECORDS 
(UFOO) 
18.6.4.3.4.2.4 (U) RECORDS OR OTHER INFORMATION PERTAINING TO A SUBSCRIBER 
(U/; 


18.6.4.3.4.2.5 (U) CONTENT 


(U/FOLO} Content is the actual substance of files stored in an account. including the 
subject line of an e-mail. 


A) (U) Unopened e-mail held in storage for 180 days or less may not be obtained using an 
administrative subpoena. A scarch warrant is required. 


B) (U) Unopened e-mail that has been held in electronic storage for more than 180 days may be 
obtained with an administrative subpoena. (In the Ninth Circuit. the opened e-mail and un- 
opened e-mail must have been in storage for 180 days before it can be obtained with an 
administrative subpoena. See Theofel v. Farey-Jones, 359 F.3d 1066.) The government must 
provide notice to the subscriber or customer prior to obtaining such content. A limited 
exception to the notice requirement is provided in 18 U.S.C. § 2705. 


C) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that provides storage services to the public (i.e. a remote computing 
service, as defined in 18 U.S.C. § 2711), may be obtained using an administrative subpoena 
with notice to the customer or subscriber, unless notice is delayed in accordance with 18 
U.S.C. § 2705. 
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D) (U) E-mail that has been opened and the content of other electronically stored files held in 
storage by an entity that does not provide electronic communication services to the public, 
such as that on the internal network of a business, may be obtained using an administrative 
subpoena. Notice to the individual is not required because this demand is not restricted by 
ECPA. 


{U} The FD-1035 administrative subpoena is not configured to obtain e-mail content 
because of developing case law in this area. This information may be obtained using an 
order issued under 18 U.S.C. § 2703(d). See DIOG Section 18.6.8.3.B. 


18.6.4.3.4.3 (U) MEMBERS OF THE NEWS MEDIA 


(UFOO Approval Requirements: An administrative subpocna directed to a provider 
of electronic communication services or any other entity seeking to obtain local and long 
distance connection records. or records of session times of calls. made by a member of 
the news media may only be issued with the specific approval of the Attorney General. 
Before proposing such a subpoena. an agent should review 28 C.F.R. § 50.10. Requests 
for AG approval must be made by the AUSA involved in the investigation consistent 
with the DOJ policies set forth in 28 C.F.R. § 50.10. Guidance on the DOJ policy may be 
obtained from the Investigative Law Unit and/or the Privacy and Civil Liberties Unit, 
OGC. 


(U) 28 C.F.R. § 50.10(b)(1)(ii) provides guidance on categories of individuals and 
entities not covered under the requirements set out above. 


18.6.4.3.5 (U) COMPLIANCE/MONITORING 
18.6.4.3.5.1 (U) LIMITS ON USE 
(U//: bIE 


18.6.4.3.5.2 (U) OVERPRODUCTION 


(U/FOUQ) If any of the information that is obtained with an administrative subpoena is 
subject to statutory privacy protections (c.g., records subject to the Electronic 
Communications Privacy Act (ECPA). Right to Financial Privacy Act (RFPA). the Fair 
Credit Reporting Act (FCRA). Health Insurance Portability and Accountability Act 
(HIPAA). or the Buckley Amendment), it must be reviewed at the time it is received by 
the employee who requested the issuance of an administrative subpoena to ensure that the 
information received from the third party provider is within the scope of the request. Any 
information received from a third party provider that is beyond the scope of the 
administrative subpoena and is subject to statutory protections must be treated as an 
overproduction. If it is determined that the overproduced material is subject to statutory 
protection. then all of the produced material must be sequestered with the employee’s 
supervisor and may not be electronically placed into any FBI database or used in the 
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investigation until one the following methods of disposition have been completed at the 
discretion of the field office or FBIHQ division that issued the administrative subpoena: 


A) (U) The employee redacts the overproduced material. The employee's supervisor must 
approve the scope of the redaction. If there is any question whether the information provided 
is within th pe of the administrative subpoena, the CDC or OGC must be consulted. The 
method of redaction is left to the discretion of the employee, but redacted information must 
not be visible, used in the investigation, or electronically placed into any FBI database. The 
method of redaction will vary depending on whether the information was provided in hard 
copy or electronically. After the overproduced information has been redacted, the remainder 
of properly produced information may be electronically placed into any database and used in 
the investigation; 


C) (U) The records are returned to the entity that produced them; or 

D) (U) The records are destroyed. 

(U) Whichever disposition is selected for the overproduction, it must be documented in 
the investigative SBP sub-file for administrative subpoenas. 


(U) Any questions concerning this process, including the review or disposition of the 
responsive records, or the statutes which cover such records, should be discussed with the 
CDC or OGC. 


18.6.4.3.5.3 (U) FACTORS FOR COMPLIANCE 


(UFOO) The following factors should be considered to ensure compliance with 
applicable laws and regulations that govern the FBI’s use of administrative subpoenas: 


A) (U/PƏYƏ) The administrative subpoena must relate to a type of investigation for which the 
subpoena is authorized; 


B) (U//FQOW) The administrative subpoena must be directed to a recipient to whom an 
administrative subpoena is authorized; 


C) (U/FOUS} The administrative subpoena may request only records that are authorized under 
the pertinent law; 


D) (U//F@UO) The administrative subpoena must be approved by an authorized official; 


E) (U/PFOUO) The administrative subpoena must be electronically placed in using the 
SBP sub-file of the investigation for record purposes. 
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EE l 


(UFOS The return of service information must be completed on the back of the original 
Administrative subpoena. Typed signature blocks do not al 


ct current practices for 


g the return of service information. For ead served a 


subpoenas, users must complete the’ 


process to satisfy the retum of service requirement. 
This copy of the subpoena must be placed in the SBP sub-file or uploaded as a 1A to the 
case file, following your office practices; 


(UABOBO) The original administrative subpoena and completed return of service must be 
maintained in a SBP sub-file of the investigation. Provided a copy of the approved 
subpoena and a copy of the completed return of service are electronically placed to the case 
file ir the SBP sub-file is not mandated. This only applies to those administrative 
subpoenas which are created through thel pplication; and 


H) (U//F@H6} If the records provided in response to the administrative subpoena are subject to 


statutory privacy protections, they must be reviewed to ensure that they are within the scope of 
the request (i.c., that there is no overproduction). If an over-production has occurred, the 
procedures outlined above must be followed. 
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18.6.5 (U) INVESTIGATIVE METHOD: GRAND JURY SUBPOENAS (COMPULSORY 
PROCESS) 


18.6.5.1 OVERVIEW OF COMPULSORY PROCESS? 


peti 


18.6.5.2 (U) APPLICATION 


(U) An FGJ is an independent panel charged with determining whether there is probable 
cause to believe one or more persons committed a particular federal offense. The FGJ makes 
ils determination based on evidence presented by the prosecuting attorney in an ex parte 
proceeding. If the FGJ believes probable cause exists, it will vote to return a “true bill” and 
the person will be indicted. An indictment is the most typical way a person is charged with a 
felony in federal court. The FGJ operates under the direction and guidance of the United 
States District Court. Generally, only witnesses for the prosecution testify before the grand 
jury. 

(U) Only the United States Attorney or an AUSA, other DOJ attorneys proseculing the matter, 
the witness under examination, an interpreter (as needed), and the stenographer or operator of 
a recording device may be present while the grand jury is in session. No judge is present 
during the presentation of evidence. although the court will sometime rule on evidentiary 
issues and will provide initial instructions to the FGJ. No person other than the grand jurors 
may be present while the FGJ is deliberating or voting. 


18.6.5.3 (U) LEGAL AUTHORITIES 


(U) An FGJ can collect evidence through the use of an FGJ subpoena. which is governed by 
Rule 6 of the FRCP. FRCP 6(c) controls the release of information obtained as part of the FGJ 
proceeding. FRCP 6(e) allows federal prosecutors to share foreign intelligence, 
counterintelligence, and terrorism-related threat information, and it is the DOJ’s policy that 
such information must be shared to the fullest extent permissible by law and in a manner 
consistent with the rule. The Attorney General has issued revised guidance for the Disclosure 
and Use of Grand Jury Information under Rule 6(e)(3)(D) (hereinafter “EGI G 
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18.6.5.4 (U) SCOPE 


(U//FOUO) This policy applics to all FBI employces engaged in a FGJ-related investigation 
who have access to FGJ information defined as “matters occurring before the grand jury” and 
are involved in operational activity. This includes FBI personnel such as task force officers 
(TFOs), task force members (TFMs). and task force participants (TFPs) (see DIOG subsection 
3.3.2), and other government agency (OGA) personnel detailed to the FBI. FGJ subpocnas 
can be used to demand documents. records. testimony of witnesses, or any other evidence 
deemed relevant by a sitting grand jury. The FBI can request the issuance of an FGJ subpoena 
in coordination with the responsible USAO in all criminal investigative matters. 


b7E 


‘GJ subpoenas are part of the investigative process. Thus. when an individual is 
indicted, further FGJ subpoenas may not be issued that are related to those offenses. 
Additional FGJ subpoenas pertaining to this individual could be issued, however. only for 
crimes which continue to be investigated and have not yet been indicted. FGJ subpoenas 
cannot be used to gather evidence for trial; trial subpoenas must be used for that purpose (see 
Rule 17 FRCP). See DIOG subsection 18.6.5.14 for guidance on the use of a FGJ subpoena in 
fugitive investigations. 
18.6.5.4.1 (U) SCOPE OF FGJ POLICY ON ADMINISTRATIVE PERSONNEL 
(U b7E 
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(UAFOUS) FBI employees who are preparing a response to a Freedom of Information Act or 
Privacy Act request may properly access grand jury material because they are considered to 
be assisting the grand jury attorney by ensuring against any improper disclosure. 


18.6.5.5 (U) APPROVAL REQUIREMENTS 


(U) There are no FBI supervisory approval requirements associated with issuing a 
subpoena, but all FGJ subpoenas must be issued by the USAO that is handling th 

Assessment or Predicated Investigation to which the subpoenaed materials or witnesses are 
relevant. 


18.6.5.6 (U) DURATION OF APPROVAL 


(U) FGJ subpoenas include a “return date,” which is the date on which the subpoenaed 
materials or testimony is due to the grand jury. 


18.6.5.7 MEMBERS OF THE NEWS MEDIA 


(U) Approval Requirements: A FGJ subpoena directed to a provider of electronic 
communication services or any other entity seeking to obtain local and long distance 
connection records, or for records of session times of calls. that were made by a member 
of the news media may only be issued with the specific approval of the Attorney General. 
Before proposing such a subpoena, an agent should review 28 C.F.R. § 50.10. Requests 
for AG approval must be made by the AUSA involved in the inve: i 
with the DOJ policies sct forth in 28 C.F.R. § 50.10. and DC 
dated February 21, 2014, DOJ News Media Policy, and the DOJ 


(U) 28 C.F.R. § 50.10(b)(1 (ii) provides guidance on categories of individuals and entities not 
covered under the requirements set out above. 


(U) Additional guidance on the DOJ policy may be obtained from the field office CDC, the 
Investigative Law Unit and the Privacy and Civil Liberties Unit, OGC. 


18.6.5.8 (U) NOTICE AND REPORTING REQUIREMENTS 
(U) There is no FBI notice or reporting requirements for FGJ subpoenas. 

18.6.5.9 (U) DEFINITION OF MATTERS OCCURRING BEFORE THE GRAND JURY 
(U 


18.6.5.9.1 (U) EXAMPLES OF MATTERS OCCURRING BEFORE THE GRAND JURY 


(U) As a general rule, the following constitute matters occurring before the grand jury: (1) the 
names of targets of the FGJ; (2) witnesses scheduled to be called by the FGJ; (3) the original 
FGJ subpoenas with any and all attachments; (4) grand jury testimony (including any and all 
transcripts of such testimony); and (5) documents that reveal the intentions or direction of the 
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(U 


18.6.5.9.2 (U) FEDERAL GRAND JURY PHYSICAL EVIDENCE AND STATEMENTS OF 
WITNESSES 


(U) Physical evidence provided to the government in response to an FGJ subpoena is subject 
to the secrecy rule regardless of whether such evidence is presented to the grand jury. 
Physical evidence provided voluntarily or obtained by means other than grand jury process 
(such as by consent or a search warrant) is not considered a matter occurring before the grand 
jury regardless of whether such evidence was Previously or is thereafter presented to the 
grand jury. The fact that the physical cyi 
subject to the grand jury secrecy rules} 


bIE 


(U) Statements of witnesses obtained as a result of grand jury process including FGJ 
subpoena, such as a statement given in lieu of grand jury testimony, are matters occurring 
before the grand jury irrespective of whether such witnesses testified before the grand jury or 
were not required to testify. Voluntary statements of witnesses made outside of the grand jury 
context (not pursuant to any grand jury process including an FGJ grand jury subpoena). 
including statements made outside the grand jury by a witness who is being prepared for 
grand jury testimony, are not matters occurring before the grand jury irrespective of whether 
the witness previously testified or will thereafter testify before the grand jury. 
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18.6.5.9.3 (U) DOCUMENTS CREATED INDEPENDENT OF GRAND JURY BUT 
OBTAINED BY GRAND JURY SUBPOENA: 


(U) As described carlier. Rule 6(c) generally prohibits disclosing matters occurring before the 
grand jury. The rule, however. docs not define that phrase. The issue of whether pre-existing 
documents fall within that prohibition has never been settled conclusively by the Supreme 
Court, although many lower courts have discussed it at length. Courts generally agree that this 
prohibition does not cover all information developed in the course of a grand jury 
investigation; rather, the secrecy rule applies only to information that would reveal the 
existence, strategy or direction of the grand jury investigation, the nature of the evidence 
produced before the grand jury, the views expressed by members of the grand jury, or 
anything clse that actually occurred before the grand jury. In addition, many courts have held 
that Rule 6{c) does not automatically protect third party documents from disclosure simply 
because they were subpoenaed by the government. Those courts have focused on whether the 
disclosure of the subpoenaed documents or their contents may tend to reveal the direction or 
strategy of the grand jury’s investigation. Due to developing law on this issue, FBI personnel 
must consult with the AUSA responsible. and if appropriate, the CDC to determine how best 
to handle such documents. 


18.6.5.9.4 (UFOO) DATA EXTRACTED FROM RECORDS OBTAINED BY GRAND 
JURY SUBPOENA: 


(U/OLO) Information extracted from business records that were obtained by grand jury 
subpoena is often used to facilitate investigations. Some of this type of data is. by statute or 
case law. subject to grand jury secrecy rules. In other investigations, determination of whether 
data must be considered subject to grand jury secrecy rules depends on the case law and local 
practice in the federal district. Information extracted from grand jury subpoenaed financial 
records subject to the Right to Financial Privacy Act of 1978 (12 U.S.C. § 3420) must be 
treated as matters occurring before a federal grand jury “unless such record has been used in 
the prosecution of a crime for which the grand jury issued an indictment or presentment or for 
a purpose authorized by rule 6(¢) of the Federal Rules of Criminal Procedure" (emphasis 
added). 


18.6.5.10 (U) RESTRICTIONS ON DISCLOSURE 


(U) As a gencral rule, no one other than a grand jury witness may disclose matters occurring 
before the grand jury. Government agents, even if called as witnesses, may not disclose 
matters occurring before the grand jury. To determine if disclosure is permitted under certain 
circumstances, or if the disclosure restrictions are not applicable because the materials are not 
matters occurring before the grand jury. see DIOG subsection 18.6.5.9. above. and relevant 
subsections of 18.6.5.12 below. 


UAOO 
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18.6.5.11 (U) DISCLOSURES BY THE GOVERNMENT REQUIRING THE COURT’S 
PERMISSION 


(UAFOUS) The government. through its attorney. may disclose matters occurring before the 
grand jury under certain listed conditions and with permission of the court. Petitions to make 
these disclosures are gencrally, but not always. filed with the court that impaneled the grand 
jury. Unless the hearing on the government’s petition is an ex parte hearing, the petition must 
be served on all parties to the proceeding and the parties must be afforded a reasonable period 
of time to respond. 


A) (U) An attorney for the government may petition for disclosure to a foreign court or 
prosecutor for use in an official criminal investigation. 

B) (U) An attorney for the government may petition for disclosure to a state, local, tribal. or 
foreign government official, if the government attorney can show that the matter may 
disclose a violation of state. tribal. or foreign criminal law, and the purpose of the disclosure 
is to enforce that law. 


C) (U) An attorney for the government may petition for disclosure to an appropriate military 
official if the government attorney can show the matter may disclose a violation of military 
criminal law under the Uniform Code of Military Justice, and the purpose of the disclosure 
is to enforce that law. 


18.6.5.11.1 (U) DISCLOSURES BY THE GOVERNMENT NOT REQUIRING THE COURT'S 
PERMISSION 


(U/AFOUO) The government. through its attorney. may disclose matters occurring before the 
grand jury without prior permission of the court under the following conditions: 


A) (U) Under Rule 6(c)(3){A), the government may disclose matters occurring before the 
federal grand jury to certain persons in certain situations provided the government does not 
disclose the grand jury's deliberations or any grand juror’s vote and the government 
provides the court that impancled the grand jury with the names of all persons to whom 
disclosure was made and certifies that the government has advised the receiving party of the 
obligation of secrecy under this rule, as set forth below in B - D. 


B) (U) Also under Rule 6(e)(3)(A), persons eligible to receive matters occurring before the 
grand jury under this subsection are: 1) an attorney for the government for use in 
performing that attorney's duty; 2) any government personnel, including state. local. tribal. 
or foreign government personnel that an attorney for the government considers necessary to 
assist in performing that attorncy’s duty to enforce federal law; and 3) a person authorized 
under 18 U.S.C. § 3322. 


C) (U) For Rule 6(e)(3)(A) purposes. OGC attorneys and CDCs are not "attorneys for the 
government." For purposes of the FRCP, it defines “attorney for the government” as “the 
Attorney Gencral, an authorized assistant of the Atorncy General. a United States Attorney, 
|and| an authorized assistant of the United States Attomey.” 
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D} (U) Rule 6(e)(3XB) authorizes grand jury material to be used "to a an attorney for the 
government in performing that attorney's duty to enforce federal criminal law." With the 
approval of the USAO, information from subpoenacd telephone records may be disclosed 
for use in unrelated federal criminal investigations in those districts where such material is 
not considered a matter occurring before a grand jury. If the USAO approves generally of 
this procedure, such information may be used in unrelated criminal investigations without 
authorization from a government attorney in each instance. 


E) (U) Under Rule 6(e)(3)(c). an attorney for the government may disclose any matter 
occurring before the grand jury to another federal grand jury. 


18.6.5.11.2 (U) RULE 6(E) EXCEPTIONS PERMITTING DISCLOSURE OF FGJ 
MATERIAL 


(U) Rule 6(e) allows certain exceptions permitting disclosure of matters occurring before the 
grand jury, which are discussed in the following sections. Rule 6(c)(3)(B) requires a federal 
prosecutor who discloses grand jury matcrial to government investigators and other persons 
supporting the grand jury investigation to promptly provide the court that impaneled the grand 
jury the names of the persons to whom such disclosure has been made and to certify that 
he/she has advised such persons of their obligation of secrecy under the Rule. In order to 
document the certification required by the Rule, government attorneys often execute and 
deliver to the court a form, normally referred to as a “Certification” or “Rule 6(e) letter.” A 
copy of this document must be maintained with the grand jury material held in the FBI's 
custody. The list of individuals authorized to access matters occurring before the grand jury. 
referred to as the “6(e) list,” is drawn from the Rule 6(e) letter. Sec also DIOG subsection 
18.6.5.4.1 above for Rule 6(c) exceptions involving administrative personnel. 


18.6.5.11.3 (U) RULE 6(E)(3)(D) DISCLOSURE EXCEPTION FOR INTELLIGENCE OR 
NATIONAL SECURITY PURPOSES 


(U) An attorney for the government may disclose any matter occurring before the grand jury 
involving foreign intelligence. counterintelligence, or foreign intelligence information to any 
federal law enforcement. intelligence. protective, immigration, national defense. or national 
security official to assist the official receiving the information in the performance of that 
official’s duties. The government attorney must file, under seal, with the court that impaneled 
the grand jury. a notice that such information was disclosed and the agencies or departments 
that received the information. As used in Rule 6(c), foreign intelligence information is 
information that relates to the ability of the United States to protect against actual or potential 
attack or grave hostile acts by a foreign power or its agents; sabotage or international 
terrorism by a foreign power or its agents or clandestine intelligence activities by an 
intelligence service or network of a foreign power or its agents; or information with respect to 
a foreign power or foreign territory that relates to the national defense or security of the 
United States or the United States conduct of foreign affairs. An atlomey for the government 
may disclose any grand jury matter involving. cither in the United States or elsewhere. a threat 
of attack or other grave hostile acts of a foreign power or its agent, a threat of domestic or 
international sabotage, or clandestine intelligence gathering activities by an intelligence 
service or network of a foreign power or by ils agent to any appropriate federal. state, local, 
tribal. or foreign government official for the purpose of preventing or responding to such 
threat or activities. 
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(U/FOUCQ) FRCP 6(c)(3)(D) allows federal prosecutors to share foreign intelligence, 

counterintelligence. and terrorism-related threat information, and it is the DOJ’s policy that 

such information must be shared to the fullest extent permissible by law and in a manner 

consistent with the rule. The Attorney General has issued FGJ practice guidelines for USAOs. 
se 


iS 
General on May 15. 2008. provides amplifying 


nied by the Deputy Attorney 
guidance. 


18.6.5.11.4 (U) FBI’s CONDUIT RULE 


(U//FOGS) Only the federal prosecutor is authorized to make an initial disclosure of Rule 

6(e)(3)(D) foreign intelligence information. As a practical matter. such disclosures are 

ordinarily accomplished through the FBI, which may have existing information-sharing 

mechanisms with authorized receiving officials. If the prosecutor intends to share information 

directly with another official. consultation with the FBI is required to ensure that disclosures 

will be consistent with the existing policy of intelligence community agencies and to ensure 

appropriate handling of sensitive or classified information| bIE 


(U/PO¢O) If. in cases of emergency, the prosecutor must disclose information before 
consulting with the FBI. the prosecutor must notify the FBI as soon as practicable. 


18.6.5.11.5 (U) OTHER STATUTORY DISCLOSURE RESTRICTIONS NOT AFFECTED 


(U) Rule 6(e)(3)(D) does not eliminate certain other information protection requirements, 
such as restrictions on disclosure of tax returns and tax information, on certain financial 
information under the Right to Financial Privacy Act. and on classified information, to name 
only a few examples. Specific statutes may impose additional burdens on disclosures. 


18.6.5.11.6 (U) RULE 6(£)(D) RECEIVING OFFICIAL RULES AND RESTRICTIONS 


A) (U) An FBI employee may become a “receiving official.” i.c., the person to whom matters 
occurring before the federal grand jury can be disclosed. if the FBI receives federal grand 
jury information developed during investigations conducted by other agencies. A recciving 
official is any federal. state, local, tribal. or foreign government official who receives grand 
jury information, disclosed by an attorney for the government, under any provision of Rule 
6(c)(3)(D). A receiving official may only use the disclosed material as necessary in the 
conduct of his/her official duties, and in a manner consistent with its s vity, FGJ 
guidelines, and any additional conditions placed on the use or handling of the information 
by the attorney for the government. The receiving official ordinarily must consult with the 
federal prosecutor before disseminating the information publicly, including in open court 
proceedings 


B) (UAFOUSS If dissemination is necessary to the performance of his or her official duties. a 
receiving official may disseminate Rule 6(c)(3)(D) information outside of that official's 
agency to other government officials. 


© {U) A receiving official, other than a forcign government official, must consult with the 
attorney for the government before disseminating Rule 6(e)(3)(D) information publicly 
{including through its use in a court proceeding that is open to or accessible to the public), 
unless prior dissemination is necessary to prevent harm to life or property. In such 
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instances, the receiving official must notify the attomey for the government of the 
dissemination as soon as practicable. 


(U) A foreign government receiving official must obtain prior consent from the disclosing 
‘ial where possible, or if the disclosing official is unavailable, from the agency that 
disseminated the information to that foreign official before dissemination of the information 
to a third government or publicly. Public dissemination includes using the information in a 
court proceeding that is open to or accessible by the public. 


to this 
cial duties. 


{U) A recciving official must take appropriate measures to restrict acce: 
information to individuals who require access for the performance of oft 


{U) A recciving official must immediately report to the disclosing attorney for the 
government: any unauthorized dissemination of Rule 6(e)(3)(D) information; or any loss, 
compromise, or suspected compromise of Rule 6(e)(3)(D) information. 


(U) Rule 6(e)(3)(D)(i) provides that receiving officials may use disclosed information only 
to conduct their “official duties subject to any limitation on the unauthorized disclosure of 
such information.” This “limitation on unauthorized disclosures” is understood to 
encompass applicable statutory, regulatory, and guideline restrictions regarding 
c ication, privacy, or other information protection, as well as any additional restrictions 
imposed by the federal prosecutor. 


(U//FECO) The FGJ Guidelines do not require the receiving official to notify the federal 
prosecutor of subsequent disclosures, except for consultation concerning public disclosures 
and consent for certain disclosures by foreign officials. The receiving official is bound by 
whatever restrictions govern his or her use and disclosure of the information as part of his 
official duties. Of note. per Rule 6(e)(3)(D)(ii). if the FBI is included in the initial 
6(c)(3)(D) letter as an entity receiving disclosure, subsequent dissemination by he FBI i is 
permitted and no additional permission or notification to the court is required. (G 


18.6.5.11.6.1 (U/HEQBO} DOCUM NAL DISCLOSURE OF 


GRAND JURY MATERIAL 


TION OF IN1 


(U) Grand jury material must be kept in such as fashion as to maintain the integrity of the 
material. Upon taking custody of grand jury material. the FB] employee must categorize 
itin a manner to identify its production source and how it was obtained, to include the 
identity of a custodian of record for documentary evidence. In licu of a Rule 6(c) letter 
from the USAO containing an exhaustive list of names of FBI personnel. an FBI record 
of additional internal disclosures must be maintained by the case agent in order to 
establish accountability. Use of this "internal certification” procedure must be authorized 
by the appropriate USAO. The internal certification document (c.g. EC) must record the 
date of disclosure as well as the identity and position of the recipient. Such internal 
disclosures may be made only in support of the same investigation in which a federal 
prosecutor has previously issued a Rule 6(c) letter. In addition, the internal certification 
document must reflect that all recipients of matters occurring before the grand jury were 
advised of the secrecy requirements of Rule 6(¢). Whenever practicable, recipients must 
be listed on this internal certification prior to disclosure. Local Rule 6(e) customs must 
govern the internal certification process used. Sec also DIOG subsection 18.6.5.4.1 above 
for Rule 6(c) exceptions involving administrative personnel. 
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18.6.5.11.7 (U) VIOLATIONS 


{U} A receiving official who knowingly violates Rule 6(¢}(3)(D) by using the disclosed 
information outside the conduct of his or her official duties. or by failing to adhere to any 
limitations on the dissemination of such information, may be subject to contempt of court 
proceedings and to restriction on future receipt of Rule 6(c)(3){D) information. 


{U} A state, local, tribal, or foreign government official who receives Rule 6(¢)(3){D) 
information, and who knowingly violates these guidelines, may be subject to contempt of 
court proceedings. 

(U) An attorney for the government who knowingly violates Rule 6(e)(3)(D) may be subject 
to contempt of court proceedings. 


18.6.5.12 (U) LIMITATION OF USE 


A) 


B) 


©) 


D) 


E) 


F) 


G) 


{U) Rule 6{(cX3XD) docs not require notice to the court of subsequent dissemination of the 
information by receiving officials. 


(U/FOY99) Disclosure of material considered matters occurring before the grand jury 
cannot be made within the FBI for unrelated investigations unless a government attorney 
has determined that such disclosure to a particular investigator is needed to assist that 
attorney in a specific criminal investigation. The ability of government attorneys to freely 
share grand jury material with other government attorneys for related or unrelated criminal 
investigations does not extend to investigators without investigation specific authorization 
from the government attorney and notice to the court. Therefore, 


(U/APQUG} If a government attorney authorizes the disclosure of material considered 
matters occurring before the grand jury in the possession of the FBI for use in an unrelated 
federal criminal matter, such approval must be documented in the “GJ” sub-file of both the 
initiated investigation file and the subsequent investigation file. That documentation will be 
in addition to any necessary supplementation to the government attorney's Rule 6(c) 
disclosure letter and/or to the internal certification disclosure list. 


(U/PPOUS} The USAO must be consulted immediately for precautionary instructions if 
material considered matters oc g before the grand jury will have application to civil 
law enforcement functions (e.g.. civil RICO or civil forfeiture). There are very limited 
exceptions that allow government attorneys to use grand jury material or information in 
civil matters (e.g.. civil penalty proceedings concerning banking law violations). These 
exceptions do not automatically apply to investigative personnel. Therefore, any similar use 
of FGJ information by the FBI must be approved in advance by the government attorney. 


(U/FPOUS) Disclosure cannot be made without a court order for use in non-criminal 
investigations, such as background investigations or name checks. 

(U//F@6)-Government personnel who are preparing a response to a Freedom of 
Information Act or Privacy Act request may properly access grand jury material under the 
Rule because they are considered to be assisting the grand jury attorney by ensuring against 
any improper disclosure. 

{U) Rule 6{(cX3XB) requires a federal prosecutor who discloses material considered matters 
occurring before the grand jury to government investigators and other persons supporting 
the grand jury investigation to promptly provide the court that impancled the grand jury the 
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names of the persons to whom such disclosure has been made and to certify that he/she has 
advised such persons of their obligation of secrecy under the Rule. In order to document the 
certification required by the Rule, government attorneys often execute and deliver to the 
court a form, normally referred to as a “Certification” or “Rule 6(c) letter.” A copy of this 
document must be maintained with the grand jury material held in the FBI's custody. 


18.6.5.133. (U#FOU® MARKING, PHYSICAL STORAGE, AND MAILING OF GRAND JURY 
MATERIAL 


(U/4FE0O} The FBI cannot make or allow unauthorized disclosure of matters occurring 


before the grand jury. If material and records obtained pursuant to the FGJ process are stored 


in FBI space b7E 


process are frequently stored in FBI space. FBI employees must report any unauthorized 
disclosure to the appropriate government attorney who, in turn. must notify the court. In order 
to protect against unauthorized disclosure, grand jury material must be secured in the 
following manner: 


D (U/AFGPO) The page cover, envelope. or container holding grand jury materials or records 
that have been identified as a “matter occurring before a grand jury” must be marked with 
the warning: "MATTERS OCCURING BEFORE THE FEDERAL GRAND JURY - 
DISSEMINATE ONLY PURSUANT TO RULE 6(c).” No grand jury stamp or mark 
should be affixed to the original material. Agents, analysts and other authorized parties 
should work from copies of such FGJ material whenever possible to ensure the original 
material retains its integrity 


2) (U/FFEBO> Access to} 
be limited to authorized persons (e.g.. those assisting an attorney for the government in a 
specific criminal investigation). All necessary precautions must be taken to protec’ 

to include maintaining the material in 
a secure location when not in use. The material must be appropriately segregated, secured, 
safeguarded and placed in the investigative GJ sub-file} 


segregate and restrict access to the material, or it can be entered i 


is entered into a computer database, the data must be marked with the &(e) 
warning and[7 ‘restricted within the system. 
3) (U/fFOUD) Registered mail or other traceable courier (such as Federal Express) approved 
by the Chief Security Officer (CSO) must be used to mail or transmit to other field offices 
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any documents containing grand jury material. Couriers and other personnel employed in 
these services will not be aware of the contents of the material transmitted because of the 
wrapping procedures specified below, and therefore, do not require a background 
investigation for this purpose. The names of persons who transport the material need not be 
placed on a 6{c) disclosure list. 


4) (U/fFOUO) Material considered matters occurring before the grand jury that is to be 
mailed or transmitted by traceable courier outside a facility must be enclosed in opaque 
inner and outer covers. The inner cover must be a sealed wrapper or envelope that contains 
the addresses of the sender and the addressee. who must be authorized to have access to the 
grand jury material. The inner cover must be conspicuously marked "Grand Jury 
Information To Be Opened By Addressee Only.” The outer cover must be sealed, 
addressed, return addressed, and bear no indication that the envelope contains grand jury 
material. When the size, weight, or nature of the grand jury material precludes the use of 
envelopes or standard packaging, the material used for packaging or covering must be of 
sufficient strength and durability to protect the information from unauthorized disclosure or 
accidental exposure. 


5) (U/AFGMO} If the government attorney determines that the sensitivity of, or threats to, 
such grand jury material necessitates a more secure transmission method, the material may 
be transmitted by an express mail service approved for the transmission of national security 
information or be hand carried by the assigned government attorney or his or her 
designated representative. 


6) (U//FOUO) Material considered matters occurring before the grand jury containing 
classified national security information must be handled. processed, and stored according 
to 28 C.F.R. Part 17. Such FGJ material containing other types of sensitive information, 
such as federal tax return information, witness security information, and other types of 
highly sensitive information that have more stringent security requirements than that 
usually required for matters occurring before the grand jury must be stored and protected 
pursuant to the security regulations governing such information and any special 
dissemination requirements provided by the organization that originated the information. 


18.6.5.13.1 (U//FOGO) PHYSICAL STORAGE OF FGJ MATERIAL 
(U// 


18-101 


Version Dated: 
—FOR-GFHICHKEHSEGNEY 
UNCLASSIFIED March 3, 2016 


UNCLASSIFIED - FOR-OFFICIAEHSE-ONEY 


Domestic Investigations and Operations Guide §18 
U/FOUS b7E 
(UFOS 
(U, 
(Uh 
bIE 
UAFETe 
b7E 
h 


18.6.5.13.2 (U#FOBUO) ELECTRONIC STORAGE OF FGJ MATERIAL 


(U/FS89 If information identified as matters occurring before the grand jury is entered into 
a computer database. the data must be marked with the 6(c) warning and access must be 
restricted within the ystenf a] s 
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18.6.5.13.3 (UF OUO) HANDLING AND STORAGE OF FGJ MATERIAL AFTER THE 
CLOSURE OF A CASE 


AE ë PE 


U/# 


18.6.5.13.4 (U/FOCO) DELETION OF ELECTRONICALLY STORED MATERIAL 
IDENTIFIED AS MATTERS OCCURRING BEFORE THE GRAND JURY 


Us) 


18-103 Version Dated: 
a ersion Dated: 
UNCLASSIFIED -FOR OFFICIAL USE ONLY March 3, 2016 


UNCLASSIFIED —FOR-OFFICIAE USE ONLY 
Domestic Investigations and Operations Guide §18 


(U/FEH®) 


18.6.5.13.5  (U/-FOO) FGJ MATERIAL CONTAINING CLASSIFIED OR OTHER 
SENSITIVE INFORMATION: 


U/FOBS: 


18.6.5.14 (U) REQUESTS FOR FGJ SUBPOENAS IN FUGITIVE INVESTIGATIONS 


(U/AFOUC) The function of the grand jury is to decide whether a person should be charged 
with a federal crime. Locating a person who has been charged is a task that is ancillary to, 
rather than a part of, that function. As such, grand jury subpoenas cannot be used as an 


investigative aid in the search for a fugitive in whose testimony the grand jury has no interest. 


Absent one of the exceptions discussed below being applicable, grand jury subpoenas for 
testimony or records related to a fugitive's whereabouts may not be requested in FBI fugitive 
investigations. 

(U//FOUO} If the grand jury has a legitimate interest in the testimony of a fugitive regarding 
another federal ongoing investigation, it may subpoena other witnesses and records in an 
effort to locate the fugitive. In this situation. the responsible Assistant Attorney General must 
approve a “target” subpoena for the fugitive before the grand jury may subpoena witnesses 
and records to locate the fugitive. 


(U//FO083 When a fugitive's present location is relevant to an offense under investigation, 
the grand jury may legitimately inquire as to the fugitive's whereabouts. Offenses such as 
harboring. misprision of a felony. and accessory after the fact are examples of crimes as to 
which the fugitive's location may be relevant evidence. If. however, the person who is 
suspected of harboring the fugitive or being an accessory after the fact has been immunized 
and compelled to testify regarding the location of the fugitive. this will likely be viewed as 
improper subterfuge. 

(U//FOE¥S}DOI policy generally forbids the use of grand jury subpoenas to locate a 
defendant charged in a federal criminal complaint with unlawful flight to avoid prosecution 
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(UFAP). UFAP investigations are, as a general rule. not prosecuted. Use of the grand jury in 
the investigation of a UFAP matter requires prior consultation with DOJ and written 
authorization to prosecute from the Assistant Attorney Gencral in charge of the Criminal 
Division. Federal indictments for UFAP require prior written approval of the Attorney 
General, Deputy Attorney General. or an Assistant Attorney General. 


18.6.5.15  (U}FGJ OVERPRODUCTION 


(U) If any of the information received in response to an FGJ subpoena is subject to statutory 
privacy protections (¢.g.. records subject to the Electronic Communications Privacy Act 
(ECPA), Right to Financial Privacy Act (RFPA). the Fair Credit Reporting Act (FCRA), 
Health Insurance Portability and Accountability Act (HIPAA). or the Buckley Amendment), it 
must be reviewed at the time it is received by the employee who requested the issuance of the 
FGJ subpoena to ensure that the information received is within the scope of the subpocna’s 
demand. Any information received from a third party provider that is beyond the scope of the 
FGJ subpoena and is subject to statutory protections must be treated as an overproduction. 
Overproduced material must not be electronically placed into any FBI application. database or 
used in any manner. Instead, the FBI employee must promptly notify the AUSA who 
authorized the issuance of the FGJ subpoena of the potential overproduction. The AUSA., in 
coordination with the FBI employee. must determine whether the information exceeds the 
scope of the FGJ subpoena. and if so, how to dispose of the overproduced material. The 
method of disposition for the overproduction must be documented in the investigation’ ] 


18.6.5.16 (U) FGJ MATERIAL COMPLIANCE AND MONITORING 


(U/FEUS) of 
every field office mi o be 
responsible for overseeing the FBI's compliance on handling. storage and labeling of FGJ 
material meeting the definition of matters occurring before the federal grand jury. As part of 
these duties, the designee must review the field office practices for handling, storage and 
labeling such material at least once per fiscal year. This review must encompass the policy 
standards set out in this section and along with any local “standing” judicial requirements. The 
results of the review(s) must be reported to the field office Division Compliance Council 

Integrity and Compliance using file number 

The field office may set its own unique 
inaugural fiscal year review date and usc that date thereafter as its basis for the annual review 
period. 


b7E 


(UFOYO) All field office specific local “standing” judicial guidance must be made available 
to employees assigned to that office. 
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18.6.6 (U) INVESTIGATIVE METHOD: NATIONAL SECURITY LETTER 


(COMPULSORY PROCESS) 


18.6.6.1 (U) OVERVIEW OF COMPLLSORY PROCESS 
UOVO: 


U/ 


18.6.6.2 (U) APPLICATION 


(U#FOGO) NSLs may be used in a national security Predicated Investigation. This method 
may not be used for assistance to other government agencies, unless the information sought is 
relevant to an open FBI Predicated Investigation. 


18.6.6.3 (U) NATIONAL SECURITY LETTERS 


A) 
B) 
©) 
D) 
E) 
F) 


18.6.6.3.1 (U) LEGAL AUTHORITY 
(U) 12 U.S.C. § 3414(a)(S)(A); 
(U) 15 U.S.C. $§ 16810 and 1681v; 
(U) 18 U.S.C. § 2709; 
(U) 50 U.S.C. § 3162; 
{U) AGG-Dom, Part V; and 
(U) An NSL may be used only to request: 


1) (U) Financial Records: The Right 
3414(a\(5); 


2) (U) Identity of Financial Institutions: 
168 luca); 


3) (U) Consumer Identifying Information: FCRA, 15 U.S.C. § 1681u(b); 


AJ, 12 U.S.C. § 


3 15 U.S.C. § 


4) (U) Full Credit Reports in International Terrorism Investigations: FCRA, 15 U.S.C. § 
1681v; and 


tion 


5) (U) Telephone Subscriber Information, Toll Billing Records. Electronic Communi 
Subscriber Information, and Electronic Communication Transactional Record: 
E jons Pi PA: 18 U.S.C. § 2709. 
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18.6.6.3.2 (U) DEFINITION OF METHOD 
{U} An NSL is an administrative demand for documents or records that are relevant to a 


Predicated Inv tion to protect against international terrorism or clandestine intelligence 
activities| | 


18.6.6.3.3 (U) APPROVAL REQUIREMENTS 


(UAFEHO) Those who approve NSLs are responsible for ensuring the investigative and 
procedural requirements have been met. They must certify that the information sought by the 
NSL is relevant to an open, predicated national security investigation. For an NSL to include a 
nondisclosure provision, the approver must determine that disclosure of the NSL may 
endanger the national security of the United States; interfere with a criminal, 
counterterrorism, or counterintelligence investigation; interfere with diplomatic relations; or 
endanger the life or physical safety of any person. Those who approve NSLs, as well as those 
designated as acting officials who will approve NSLs. must have completed the Virtual 
Academy course on NSLs, reviewed DIOG Section 18.6.6. (National Security Letter), and if 
appropriate, received NSL training from the CDC/ADC or a National Security Law Branch 
(NSLB) attorney prior to approving NSLs. 


(U/FEHO) The process for creating an NSL involves two documents: the NSL itself and the 
EC approving the issuance of the NSL. The Director has delegated the authority to sign NSLs 
to the Deputy Director. Executive Assistant Director, and Associate EAD for the National 
Security Branch; Assistant Directors and all DADs for the Counterterrorism, 
Counterintelligence. and Cyber Divisions. and the Weapons of Mass Destruction Directorate; 
General Counsel; Deputy General Counsel for the National Security Law Branch; Assistant 
Directors in Charge in New York. Washington, DC. and Los Angeles; and all SACs in all 
HQ-A 1487720 Serial 515 (May 15, 2012). No other delegations are 


(U/AFEHO) In addition to being signed by a statutorily required approver, an NSL must be 
approved by a CDC. ADC (or attorney acting in that capacity), or an NSLB attorney. 


18.6.6.3.4 (U) STANDARDS FOR ISSUING NSLS 
(UFOS) 
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(U) SPECIAL PROCEDURES FOR REQUESTING COMMUNICATION 


SUBSCRIBER INFORMATION 
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the employee should 


consider whether an NSL is the least intrusive and reasonable means based upon the 
circumstances of the investigation to obtain the information. 


18.6.6.3.6 


(U) DURATION OF APPROVAL 


a 


18.6.6.3.7 


( U/FOBO} 


(U//FOGO}| 


A) 


B) 


(U//FOUD 


UH 


(U) SPECIFIC PROCEDURES FOR CREATING NSLS 


18-109 
UNCLASSIFIED - FOR-GFFICIAL CSE ONET 


Version Dated: 
March 3, 2016 


bIE 


bIE 


b7E 


b7E 


b7E 


b7E 


b7E 


b7E 


bIE 


UNCLASSIFIED -FOR GFFICTAE GSE-ONEX 


©) 


D) (UFOS) 


E) (U/AB 


F) U/FOUS) 


G) (UFOS 


(U//FOUQ) 


(UFOO) 


Domestic Investigations and Operations Guide 


18-110 
UNCLASSIFIED =FOR-OFFIGCHKEHSEONLY 


§18 


Version Dated: 
March 3, 2016 


bIE 


bIE 


b7E 


b7E 


b7E 


bIE 


b7C 


(Uh 


A) 


B) 


C} 


D} 


E) 


F) 


G) 


(U/ 


UNCLASSIFIED --FOR-QFFICIAL USE ONLY- 


18.6.6.3. 


ULEOVO? 


(UIP 


Domestic Investigations and Operations Guide 


7.1 (U) COVER EC APPROVING AN NSL 


(U/FOHS) 


CUB 


18-111 
UNCLASSIFIED -FOR-GFFICIAE CSE ONEY 


§18 


Version Dated: 
March 3, 2016 


bIE 


bIE 


b7E 


b7E 


b7E 


b7E 


b7E 


b7E 


b7E 


bIE 


bIE 


H) 


D 


K) 


UNCLASSIFIED -FOR-OFHEMEHUSE-ONEY 


(UAFEDS) 


Domestic Investigations and Operations Guide 


§18 


wrreve ————————————————— ] 


U//FORS) This list is not exhaustive, 
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18.6.6.3.7.3 (U) COMMUNITY OF INTEREST INFORMATION 


bIE 


18.6.6.3.7.4 (U) CONTACT WITH MEMBERS OF THE NEWS MEDIA BYA] b7E 


(U bTE 


18.6.6.3.7.5 (U) EMERGENCY CIRCUMSTANCES 


(U/FEO}ECPA protects subscriber or communications transactional information from 
disclosure by providers of electronic communication services. Generally. an NSL, grand 
jury subpoena, or another form of legal process must be used to compel a communication 
service provider to disclose subscriber or transactional information. In emergency 
circumstances, however. the provider may voluntarily disclose information to the FB] if 
the provider. in good faith. believes that an emergency involving danger of death or 
serious physical injury to any person exists and requires disclosure without delay. As a 
matter of FBI policy, when there is a danger of death or serious physical injury that does 
not permit the proper processing of an NSL, an administrative subpoena (if permissible), 
or a grand jury subpoena, then a letter to the provider citing 18 U.S.C. § 2702 may be 
used to request emergency disclosure. if approved by a SAC. ASAC, or FBIHQ Section 
Chief. If time does not permit the issuance of an emergency letter that cites 18 U.S.C. § 
2702. then an oral request to the provider may be made, but the oral request must be 
followed-up with a letter to the provider. In either situation, a lesan, which BIs 
automatically generates the letter, must be completed. 


(U//FORS) b7E 


(UA b7E 
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ea 


18.6.6.3.8 (U) NOTICE AND REPORTING REQUIREMENTS 


UFOS) NSLB compiles NSL statistics for reporting to Congress. The NSL subsystem 
= automatically records the information needed for Congressional reporting. If the 
NSL is created outside the subsystem, then the NSL’s cover EC must include the information 
necessary for NSLB to report NSL statistics accurately, i.c., delineate the number of targeted 
facilitics/accounts in cach NSL issued to an NSL recipient. 


(U//FOUC) NSLB also reports to Congress the USPER status of the target (as opposed to the 
subject of the investigation) of all NSLs. other than NSLs that seck only subscriber 
information. While the subject of the investigation is often the target of the NSL, that is not 
always the case. The EC must record the USPER status of the target of the NSL — the person 
whose information the FBI is seeking. If the NSL is seeking information about more than one 
person, the EC must record the USPER status of cach person. 


18.6.6.3.9 (U) RECEIPT OF NSL INFORMATION, REVIEW FOR OVERPRODUCTION. 
AND RELEASING THE INFORMATION 


> 


(U//FOBO) 


(U/-BOES: 


(U/FOUD) 
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18.6.6.3.11 (U) RETENTION OF NSL INFORMATION 


Uh bIE 


U b7E 


18.6.6.3.12 (U) SERVICE AND RETURNS OF NSLS 


18.6.6.3.12.1 (U//FOYO} ELECTRONIC SERVICE AND RETURN 


(U/[FORO) BIE 


18-116 


UNCLASSIFIED - FGOR-GFRICIALUSE ONLY Version Dated: 
March 3, 2016 


UNCLASSIFIED -FGR-OFFIGHAL USE-ONEY 
Domestic Investigations and Operations Guide §18 


UAFOUS" 


(U/FOUD] 


A) (U/He 


> pm 


(U/ROLIO) 


(U/FOUS’ 


18.6.6.3.12.2 (U/AF@8O}PERSONAL SERVICE AND RETURN 
(U// 


18-117 


UNCLASSIFIED - FOR-OFFICHLLSE-ONLY Version Dated: 


March 3, 2016 


bIE 


BIE 


b7E 


b7E 


b7E 


b7E 


b7E 


bIE 


UNCLASSIFIED -FOR UFFICIAL USE CREY— 


Domestic Investigations and Operations Guide §18 
b7E 
18.6.6.3.12.3 (U//POŅO) RESTRICTED MAIL SERVICE AND RETURN 
(UFOS BTE 
18.6.6.3.12.4 (U//FOBO) FAX SERVICE AND RETURN 
(Us bIE 


») (wiped ors 


B)_(U//FO¢8} bTE 


(= 7 j 


e 
L 


18.6.6.3.12.5  (U/HFGBO} COMBINATION SERVICE AND RETURN 
U//FOUO} pIE 


18.6.6.3.13 (U) DISSEMINATION OF NSL INFORMATION 


(U//FOUS} Subject to certain statutory limitations, information obtained in response to an 
NSL may be disseminated according to gencral dissemination standards in the AGG-Dom. 
The Electronic Communications Privacy Act (ECPA) (telephone and electronic 
communications transactional records) and the Right to Financial Privacy Act (RFPA) 
(financial records) permit dissemination if consistent with the AGG-Dom and the information 
is clearly relevant to the responsibilities of the recipient agency. The Fair Credit Reporting 
Act (FCRA) permits dissemination of the identity of financial institutions and consumer 
identifying information to other federal agencies as may be necessary for the approval or 
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conduct of a foreign counterintelligence investigation. FCRA imposes no special rules for 
dissemination of full credit reports. 


neither the 


NSL nor the return information ts classified] 


18.6.6.3.14 (U) SPECIAL PROCEDURES FOR HANDLING RIGHT TO FINANCIAL 
PRIVACY ACT INFORMATION AND OTHER INFORMATION 


a 


(U//FOUOS| 


(U/FORO} 
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18.6.6.3.15_ (U) PAYMENT FOR NSL-DERIVED INFORMATION 


(U//F6E8) No legal obligation exists for the FBI to compensate recipients of NSLs issued 
pursuant to ECPA (telephone and electronic communications transactional records) or FCRA, 
15 U.S.C. § 1681 v (full credit reports in international terrorism investigations), and therefore 
no payment should be made in connection with those NSLs. See EC 319X-HQ-A1487720- 
OGC, serial 222, for a form letter to be sent in response to demands for payment concerning 
these NSLs. 


(UAFOUQ) Compensation for responding to NSLs issued pursuant to RFPA (financial 
records) and FCRA § 1681u (identity of financial institutions and consumer identifying 
information) is covered by a fee schedule adopted under DOJ's Cost Reim 
Guidance pike ECPA. 


18.6.6.3.16 (U) JUDICIAL REVIEW OF NSLS 


(U//BQLIQ) All NSLs should include the necessary legal notices. Specifically, an NSL issued 
by the FBI must inform the recipient of the right to judicial review of the NSL pursuant to 18 
U.S.C. § 351 1(a). See Doe v. Mukasey. 549 F.3d 861 (2d Cir. 2008). An NSL issued by the 
FBI must also inform the recipient of the right to judicial review of any nondisclosure 
requirement imposed in connection with the NSL. See. e.g. 18 U.S.C. § 2709(d). An NSL 
must specifically advise that. if the recipient wishes to have a court review a nondisclosure 


requirement imposed in connection with an NSL. the recipient may notify the Government, 
which must then initiate judicial review proceedings] Jr it wants to maintain bIE 
nondisclosure of the NSL. If the FBI determines that nondisclosure continues to be necessary 

(sce below paragraph for statutory standard for nondisclosure), the Government must 

demonstrate to a federal judge the need for continued nondisclosure and obtain a judicial 

order requiring such nondisclosure. The nondisclosure requirement will remain in effect 

unless and until there is a final court order holding that disclosure is permitted. 


(U/EOUQ) In any judicial review proceeding regarding a nondisclosure requirement in 
connection with an NSL. the Government will bear the burden of persuading the district court 
that there is good reason to believe that disclosure may result in at least one of the enumerated 
harms set forth in the NSL statues, e.g.. 18 U.S.C. § 2709{c), which are: a danger to the 
national security of the United States; interference with a criminal. counterterrorism, or 
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counterintelligence investigation; interference with diplomatic relations; or danger to the life 
or physical safety of any person. that is related to an authorized investigation to protect 
against international terrorism or clandestine intelligence activities. Accordingly, the field 
office or FBIHQ Division that issued the NSL, in conjunction with OGC, must coordinate 
with DOJ and the United States Attorney’s Office to ensure that the FBI’s certification is 
sufficient to meet the FBI’s burden of proof. 


18.6.6.3.17 (U) REVIEW OF NONDISCLOSURE REQUIREMENT IN NSLS 


(U//FOUO) The USA FREEDOM Act of 2015 requires the FBI to review at certain intervals 
during the investigation all National Security Letters (NSL) that included a nondisclosure 
requirement pursuant to procedures adopted by the Attorney General. Pursuant to the Attorney 
General Termination Procedures for National Security Letter Nondisclosure Requirement 
(Procedures), issued November 24, 2015. the review is to determine whether the 
nondisclosure requirement in an NSL should continue or be terminated. Under these 
Procedures, the nondisclosure requirement of an NSL shall terminate upon the closing of any 
investigation in which an NSL containing a nondisclosure provision was issued except where 
the FBI makes a determination that one of the exisiting statutory standards for nondisclosure 


s satisfied. Pursuant to the Procedures, starting February 21.2016, when (i) an open 
investigate file reaches its third-year anniversar b7E 


and (ii) an investigative file is closed. an NSL nondisclosure review must occur. 
If an investigation is closed before its third-year anniversary. then the NSL nondisclosure 
review will occur once. that is. when the investigation closes. There are no NSL nondisclosure 
reviews beyond the third-year anniversary and/or when the investigative file is closed. 
(UFOS) b7E 
(U// b7E 
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18.6.7 (U) INVESTIGATIVE METHOD: FISA ORDER FOR BUSINESS RECORDS 
(COMPULSORY PROCESS) 


18.6.7.1 (U) OVERVIEW OF COMPULSORY PROCESS 
Uh 


E 


18.6.7.2 (U) APPLICATION 


(U//FOBO) FISA Business Records Orders may be used during authorized national securit 
investigations 


When collecting positive foreign 
intelligence. if the subject is a non-USPER, a request for business records pursuant to 50 
U.S.C. §§ 1861-63 is lawful. 


18.6.7.3 (U) BUSINESS RECORDS UNDER FISA 


18.6.7.3.1 (U) LEGAL AUTHORITY 
(U) 50 U.S.C. §§ 1861-63 
18.6.7.3.2 (U) DEFINITION OF METHOD 


U) A FISA order for business records, is an order for a third party to produce 
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18.6.7.3.3 (U) APPROVAL REQUIREMENTS 


(U// bIE 


18.6.7.3.4 (U) DURATION OF COURT APPROVAL 

(U) Authority for a FISA business records order is established by court order. 
18.6.7.3.5 (U) NOTICE AND REPORTING REQUIREMENTS 

(U) There are no special notice or reporting requirements. 
18.6.7.3.6 (U) COMPLIANCE REQUIREMENTS 


(U) The employee who receives material produced in response to a FISA business records 
order must do the following: 


A) (UTSES Handle the material as required by the Standard Minimization Pr 


b7E 


18.6.7.3.7 (U) SEE THE CURRENT CLASSIFIED FISA BUSINESS RECORDS STANDARD 
MINIMIZATION PROCEDURES: 


18.6.7.3.7.1 (U) FISA OVERCOLLECTION 
(U/F bIE 
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18.6.8 (U) INVESTIGATIVE METHOD: STORED WIRE OR ELECTRONIC 
COMMUNICATIONS AND TRANSACTIONAL RECORDS a 


18.6.8.1 (U) SUMMARY 


(U//F@UO) FBI employees may acquire the contents of stored wire or clectronic 
communications and associated transactional records—including basic subscriber 
information—as provided in 18 U.S.C. §§ 2701-2712 (Electronic Communications Privacy 
Act (ECPA)). Requests for voluntary disclosure under the emergency authority of 18 U.S.C. § 
2702 require prior approval from the ficld office ASAC or FBIHQ Section Chief when 
appropriate. 


(UFOO) All requests for information from electronic communication service providers 
(e.g.. telephone companies. internet service providers) pertaining to a subscriber or customer 
must comply with ECPA. As used in ECPA, the term “information pertaining to a subscriber 
or customer” should be read broadly. It includes, for example, information regarding whether 
a particular individual has an account with a covered provider. Thus, unless done in 
accordance with ECPA, an FBI employee may not ask a telephone company or internet 
service provider whether John Smith has an account with the company (i.e., the FBI employee 
may not informally seek information that is statutorily protected prior to the issuance of 
appropriate process or the existence of an exception to ECPA). In addition. based on a 
November 5, 2008 interpretation of ECPA from the Office of Legal Counsel. the FBI may not 
ask a telephone company whether a given telephone number that the company services has 
been assigned to an individual. In short. in order to obtain any information specific to the 
subscriber from a telephone company or electronic communication service provider, the FBI 
must provide legal process pursuant to 18 U.S.C. §§ 2703 or 2709 or the request must fall 
within the limited exceptions established in 18 U.S.C. § 2702, and discussed below. 


U/FOUO 


18.6.8.2 (U) APPLICATION 
Us 


18.6.8.2.1 (U) STORED DATA 


(U) The Electronic Communications Privacy Act (ECPA)—18 U.S.C. §§ 2701-2712— 
governs the disclosure of two broad categories of information: (i) the contents of wire or 
electronic communications held in “electronic storage” by providers of “electronic 
communication service” or contents held by those who provide “remote computing service” 
to the public; and (ii) records or other information pertaining to a subscriber to or customer of 
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such services. The category of “records or other information” can be subdivided further into 
subscriber records (listed in 18 U.S.C. § 2703{c)(2)) and stored traffic data or other records. 


(U) Records covered by ECPA include all records that are related to the subscriber. including 
buddy lists, “friend” lists (MySpace), and virtual property owned (Second Life). These other 
sorts of records are not subscriber records and cannot be obtained with a subpoena under 18 
U.S.C. § 2703(c){2) or an NSL under 18 U.S.C. § 2709. 


18.6.8.2.2 (U) LEGAL PROCESS 


(U) The legal process for obtaining disclosure will vary depending on the type of information 
sought and whether the information is being voluntarily provided under 18 U.S.C. § 2702 
{c.g., with consent or when emergency circumstances require disclosure) or the provider is 
being compelled to provide the information under 18 U.S.C. § 2703, as outlined below. The 
process for compelling production under 18 U.S.C. § 2709 is discussed in the NSL section 
above. 


18.6.8.2.3 (U) RETRIEVAL 


(U) Contents held in “electronic storage” by a provider of “electronic communication service” 
for 180 days or less can only be obtained with a scarch warrant based on probable cause. 
Accordingly. such records may only be obtained during a Full Investigation. 


(U) Contents held by those who provide “remote computing service” to the public and 
contents held in “electronic storage” for more than 180 days by an “electronic communication 
service” provider can be obtained with: a warrant, a subpoena with prior notice to the 
subscriber or customer; or an order issued by a court under 18 U.S.C. § 2703(d) when prior 
notice has been provided to the customer or subscriber (unless the court has authorized 
delayed notice). 


(U) Title 18 U.S.C. § 2705 establishes the standard to delay notice for an initial period of up 
to 90 days. Records or other information pertaining to a subscriber to or customer of such 
services, including basic subscriber information, can be obtained with a search warrant or an 
18 U.S.C. § 2703(d) order without notice. 


18.6.8.2.4 (U) BASIC SUBSCRIBER INFORMATION 


(U) Basic subscriber information, as described in 18 U.S.C. § 2703(c)(2). can be compelled 
by a grand jury or administrative subpoena without notice. 


18.6.8.2.5 (U) PRESERVATION OF STORED DATA 


(U) The government is authorized under 18 U.S.C. § 2703(f) to direct a provider to preserve 
records or other information (stored records or communications) in its possession for 90 days 
(which may be extended for an additional 90-days) pending issuance of applicable legal 
process for disclosure. To make a preservation request. the FBI must believe that the records 
will subsequently be sought by appropriate legal process. 


18.6.8.2.6 (U) COST REIMBURSEMENT 


(U) 18 U.S.C. § 2706 requires the government to reimburse for costs incurred in providing the 
contents of communications. records, or other information obtained under 18 U.S.C. §§ 2702. 
2703. or 2704, except that reimbursement is not required for records or other information 


18-126 
UNCLASSIFIED — FOR-GBEICIAL USE ONLY 


Version Dated: 
March 3, 2016 


UNCLASSIFIED -FOR-OFFICHALHSE-ONEY 
Domestic Investigations and Operations Guide §18 


maintained by a communications common carrier that relate to telephone toll records and 
telephone listings obtained under 18 U.S.C. § 2703. In essence. the government does not have 
to reimburse for the cost of producing records that the provider maintains in the ordinary 
course of its business. 


18.6.8.3 (U} LEGAL AUTHORITY 
(U) 18 U.S.C. §§ 2701-2712 
{U) AGG-Dom, Part V.9 


(U) ECPA— 18 U.S.C. §§ 2701-2712— creates statutory privacy rights for the contents of 
communications in “electronic storage” and records or other information pertaining to a 
subscriber to or customer of an “electronic communication service” and a “remote computing 
service.” The statutory protections protect the privacy of an individual’s electronic data 
contained in a networked account—that may otherwise fall outside the scope of the 
protections afforded by the Fourth Amendment—when such account or its service is owned or 
managed by a third-party provider. 


(U) ECPA gencrally: (i) prohibits access to the contents of wire or clectronic communications 
while in “electronic storage” unless authorized (18 U.S.C. § 2701), (ii) prohibits a provider of 
service to the public from disclosing the contents of wire or electronic communications while 
held in “electronic storage,” and prohibits divulging to the government any information 
pertaining to a subscriber to or customer of such service unless authorized (18 U.S.C. § 2702); 
and (iii) authorizes the government to compel disclosure from a provider of stored contents of 
a wire or electronic communication and records or other information pertaining to a 
subscriber to or customer (18 U.S.C. § 2703). ECPA provides for reimbursement of costs 
incurred in providing the information acquired. 


(U) 


18.6.8.4 (U) ECPA DISCLOSURES 


(U) ECPA authorities can be divided into two categories: (i) compelled disclosure—legal 
process to compel providers to disclose the contents of stored wire or electronic 
communications (including e-mail and voice mail—opened and unopened) and other 
information, such as account records and basic subscriber information; and (ii) voluntary 
disclosure of such information from service providers. Each of these authorities is discussed 
below. 


18.6.8.4.1 (U) DEFINITIONS 


A) (U) Electronic Storage: is “any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof.” or “any storage of such 
communication by an electronic communication service for purpo: of backup protection of 
such communication.” 18 U.S.C. § 2510(17). In short, "electronic storage“ refers only to 
temporary storage. made in the course of transmission, by a provider of an electronic 
communication service. 


B) (U) Remote Computing Service (RCS): is a service that provides “to the public” computer 
storage or processing services by means of an electronic communications system. 18 U.S.C. § 
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2711(2). In essence. a remote computing service is an off-site computer that stores or 
processes data for a customer. 


C) (U) Electronic Communications System: is “any wire, radio. electromagnetic, photo optical 
or photo electronic facilities for the transmission of wire or electronic communications, and 
any computer facilities or related electronic equipment for the electronic storage of such 
communications.” 18 U.S.C. § 2510(14). 


D) (U) Electronic Communication Service (ECS): is “any service that provides to users thereof 
the ability to send or receive wire or electronic communications.” 18 U.S.C. § 2510(15). For 
example, telephone companies and electronic mail companies generally act as providers of 
electronic communication services. 


18.6.8.4.2 (U) COMPELLED DISCLOSURE 


(U) 18 U.S.C. § 2703 lists five types of legal process that the government can use to compel a 
provider to disclose certain kinds of information. The five mechanisms, in descending order 
of required threshold showing are as follows: 


A) (U) Search warrant; 
B) (U) 18 U.S.C. § 2703(d) court order with prior notice to the subscriber or customer; 
C) (U) 18 U.S.C. § 2703(d) court order without prior notice to the subscriber or customer; 
D) (U) Subpoena with prior notice to the subscriber or customer; and 
E) (U) Subpoena without prior notice to the subscriber or customer. 

(U) 


18.6.8.4.2.1 (U//FOBC) COMPEL 
THE NEWS MEDIA 


ED DISCLOSURE REGARDING MEMBERS OF 


(Us 
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(U) 28 C.F.R. § 50.10(b)(1)(ii) provides guidance on categories of individuals and 
entities not covered by, and therefore not entitled to the protections of the DOJ policy set 
out above. 


18.6.8.4.2.2 (U/FPFOTO) NOTICE—ORDERS NOT TO DISCLOSE THE EXISTENCE 
OF A WARRANT, SUBPOENA, OR COURT ORDER 


(U/P640} FBI cmployces may obtain a court order directing network service providers 
not to disclose the existence of compelled process if the government has no legal duty to 
notify the customer or subscriber of the process. If an 18 U.S.C. § 2703(d) order or 18 
U.S.C. § 2703(a) warrant is being uscd. a request for a non-disclosure order can be 
included in the application and proposed order or warrant. If a subpoena is being used to 
obtain the information, a separate application to a court for a non-disclosure order must 
be made. 


18.6.8.4.2.3 (U) LEGAL STANDARD 


(U/-FEEO) A court may order an electronic communications service provider or remote 
computing service not to disclose the existence of a warrant, subpoena, or court order for 
such period as the court deems appropriate. The court must enter such an order if it 
determines that there is reason to believe that notification of the existence of the warrant, 
subpoena, or court order will result in: 


A) (U) Endangering the life or physical safety of an individual; 
B) (U) Flight from prosecution; 

C) (U) Destruction of or tampering with evidence; 

D) (U) Intimidation of potential witnesses; or 


E) (U) Otherwise seriously jeopardizing an investigation or unduly delaying a trial. 18 U.S.C. § 
2705(b). 


18.6.8.4.2.4 (U) SEARCH WARRANT 


(U//FEHS) Investigators can obtain the full contents of a network account with a search 
warrant issued pursuant to FRCP Rule 41. However, FRCP Rule 41 search warrant may 
not be issued in Preliminary Investigations. See DIOG Section 18.7.1.3.4.4. 


18.6.8.4.2.5 (U) COURT ORDER WITH PRIOR NOTICE TO THE SUBSCRIBER OR 
CUSTOMER 

(U/FOO} Investigators can obtain everything in a network account except for 
unopened c-mail or voice-mail stored with a provider for 180 days or less using a 18 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in “electronic storage" (c.g.. unopened e-mail) 
for less than 180 days, and those that have been in “electronic storage” for longer or that 
are no longer in “electronic storage” (e.g.. opened e-mail). 


(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and cither give 
prior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
2705(a). may obtain: 
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A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an clectronic communications system for more than one hundred and cighty days.” 18 U.S.C. 
§ 2703{a). 

B) (U) “The contents of any wire or electronic communication” held by a provider of remote 
computing service “on behalf of . . . a subscriber or customer of such remote computing 
service." 18 U.S.C. §§ 2703(b)(1)(B)(ii), 2703 (b)(2); and 

C) (U) Everything that can be obtained using an 18 U.S.C. § 2703(d) court order without notice. 


(U) 


18.6.8.4.2.5.1 (U) LEGAL STANDARD 


(U) To order delayed notice. the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [Iead to] destruction of or tampering 
with evidence; [Icad to] intimidation of potential witne: or... otherwise seriously 
jeopardiz[c] an investigation or unduly delay] ] a trial." 18 U.S.C. §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew cach time an extension of the 
delayed notice is sought. 


18.6.8.4.2.5.2 (U) NATIONWIDE SCOPE 


(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant to18 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction” may 
issue a 18 U.S.C. § 2703(d) order); 18 U.S.C. § 2711(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C. § 2703(d) orders may also be issued by state courts. Scc 18 U.S.C. §§ 


2711(3), 3127(2\(B). These orders issued by state courts, however. do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C. $$ 2711(3). 


18.6.8.4.2.6 (U) COURT ORDER WITHOUT PRIOR NOTICE TO THE SUBSCRIBER 
OR CUSTOMER 


(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of: 
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A) (U) All “record(s) or other information pertaining to a subscriber to or customer of such 
service (not including the contents of communications [held by providers of electronic 
communications service and remote computing service|)." and 


B) (U) Basic subscriber information that can be obtained using a subpoena without notice. 18 
U.S.C. § 2703(c)(1). 


18.6.8.4.2.6.1 (U) TYPES OF TRANSACTIONAL RECORDS 


(U) The broad category of transactional records includes all records held by a service 
rovider that pertain to the subscriber beyond the specific records listed in 2703(c)(2 


b7E 


(U/EOYO) b7E 


18.6.8.4.2.6.2 (U) CELL SITE AND SECTOR INFORMATION 


(U) Cell site and sector information is considered “a record or other information 
pertaining to a subscriber” and therefore, production of historical and prospective cell site 
and sector information may be compelled by a court order under 18 U.S.C. § 2703(d). 
Requests made pursuant to 18 U.S.C. § 2703(d) for disclosure of prospective cell site and 
sector information—which is delivered to law enforcement under Communications 
Assistance for Law Enforcement Act (CALEA) at the beginning and end of calls— must 
be combined with an application for pen register/trap and trace device. Some judicial 
districts will require a showing of probable cause before authorizing the disclosure of 
prospective cell site and sector information. 


8684263 (Yr 

(U) b7E 

(U/FOUO) b7E 
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bIE 


(U) bIE 


(U) b7E 


8.6.8.4.2.6.4 (U) LEGAL STANDARD 


(U) A court order under 18 U.S.C. § 2703(d) is known as an “articulable facts” court 
order or simply a "d” order. This section imposes an intermediate standard to protect on- 
line transactional records. It is a standard higher than a subpoena. but not a probable 
cause warrant. 


(U) In applying for an order pursuant to 18 U.S.C. § 2703 (d). the FBI must state 
sufficient specific and articulable facts for the court to find that there are reasonable 
grounds to believe that the contents of a wire or electronic communication, or the records 
or other information s: f i i imin 
investigation. 


b7E 


18.6.8.4.2.7 (U) SUBPOENA WITH PRIOR NOTICE TO THE SUBSCRIBER OR 
CUSTOMER 


(U/4FOH6) Investigators can subpoena opened e-mail from a provider if they give prior 

notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 

that there is reason bIE 
to believe notification of the existence of the subpoena may have an adverse result. 


(U) FBI employees who obtain a subpoena and give prior notice to the subscriber or 
comply with the delayed notice provisions of 18 U.S.C. § 2705(a) may obtain: 
A) (U) “The contents of any wire or electronic communication" held by a provider of remote 


computing service “on behalf of . . . a subscriber or customer of such remote computing 
service.” 18 U.S.C. § 2703(b) 1X BG). § 2703(b)(2); 


B) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days." 18 U.S.C. 
§ 2703{a); and 
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C) (U) Basic subscriber information listed in 18 U.S.C. § 2703(c)(2). 


(U) As a practical matter, this means that 


(U) Legal standards for delaying notice: The supervisory official must certify in writing 


that "there is reason to believe that notification of the existence of the court order may... 
endanger{] the life or physical safety of an individual; [lead to] Might from prosecution; 
[Iead to] destruction of or tampering with evidence; [lead to] intimidation of potential 
witnesses; or... otherwise seriously jeopardiz[c] an investigation or unduly delay|] a 
trial.” 18 U.S.C. §§ 2705(a)(1 (A), 2705(a)(2). This standard must be satisfied anew 
every time an extension of the delayed notice is sought. This documentation must be 
placed with the subpoena in the appropriate investigative file. 


18.6.8.4.2.8 (U) SUBPOENA WITHOUT PRIOR NOTICE TO THE SUBSCRIBER OR 
CUSTOMER 


(UAPEHO) Without notice to the subscriber or customer, investigators can subpoena 
basic subscriber information: 


(U) name; address; local and long distance telephone connection records, or 
records of session times and durations; length of service (including start date) and 
types of service used; telephone or instrument number or other subscriber 
number or identity, including any temporarily assigned network address; and 
means and source of payment for such service (including any credit card or bank 
account number)[.]” 18 U.S.C. § 2703(c)(2). 
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A) (U) Legal Standard: The legal threshold for issuing a subpoena is relevance to the 
investigation. Courts are reluctant to review the “good faith” issuance of subpoenas as long as 
they satisfy the following factors”: @) the investigation is conducted pursuant to a legitimate 
purpose; (ii) the information requested under the subpoena is relevant to that purpose; (iii) the 
agency does not already have the information it is seeking with the subpoena; and (iv) the 
agency has followed the necessary administrative steps in issuing the subpoena. 


(U/FEH) In the event that a federal grand jury subpoena is used, however, appropriate 
protections against disclosure must be followed in compliance with FRCP Rule 6(e). 


B) (U/FOUS) bIE 


C) (U) Members of the News Media: Approval of the Attorney general must be obtained prior to 
seeking telephone billing records of a member of the news media. (See DIOG Section 
18.6.5..8) 


18.6.8.4.3 (U) VOLUNTARY DISCLOSURE 
(U) b7E 


A) (U) Service NOT Available to the Public: ECPA does not apply to providers of services that 
are not available "to the public;" accordingly such providers may freely disclose both contents 
and other records relating to stored communications. Andersen Consulting v. UOP, 991 F. 
Supp. 1041 (N.D. Ill. 1998) (giving hired consulting firm employees access to UOP’s e-mail 
system is not equivalent to providing e-mail to the public). 


B) (U) Services That ARE Ayailable to the Public: If the provider offers services to the public, 
then ECPA governs the disclosure of contents and other records. 


C) (U) If the provider is authorized to disclose the information to the government under 18 
U.S.C. § 2702 and is willing to do so voluntarily, law enforcement docs not need to obtain a 
legal order or provide other legal process to compel the disclosure. 


D) (U) If a provider voluntarily discloses under the statute, there is no follow-up legal process 
required or available. If the provider, on the other hand, either may not or will not disclose the 
information voluntarily, FBI employees must rely on compelled disclosure provisions and 
obtain the appropriate legal orders. 

1) (U) Voluntary Disclosure of Stored Contents - ECPA authorizes the voluntary disclosure 
of stored contents when: 
a) (U) The originator, addressee, intended recipient. or the subscriber (in the case of 
opened e-mail) expressly or impliedly consents, 18 U.S.C. § 2702(b)(3); 


b) (U) The disclosure "may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service." 18 U.S.C. § 
2702(bX5); 


45 (U) United States v. Morton Salt Co., 338 U.S. 632, 642-43 (1950). 
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c) (U) The provider “in good faith. believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 18 U.S.C. § 2702(b)(8): 


d) (U/FEUQ) An emergency disclosure under this statutory exception is justified when 
the circumstances demand action without delay to prevent death or serious bodily 
injury; the statute does not depend on the immediacy of the risk of danger itself. For 
BIE 


H.R Rep. No. 107-497 at 13-14 (2002) accompanying The Cyber Security 
Enhancement Act of 2002, H.R. 3482, which passed as part of the comprehensive 
Homeland Security Act of 2002, Pub. L. No. 107-296, § 225 116 Stat. 2135 (2002). 


e) (U) The disclosure is made to the National Center for Missing and Exploited Children, 
in connection with a report submitted thereto under Section 227 of the Victims of Child 


Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702]b1]6]); or 


f) (U) The contents are inadvertently obtained by the service provider and appear to 
pertain to the commission of a crime. Such disclosures can only be made to a law 
enforcement agency. 18 U.S.C. § 2702(b)(7) 


2) (U) Voluntary Disclosure of Non-Content Customer Records - ECPA permits a 
provider to voluntarily disclose non-content customer records to the government when: 


a) (U) The customer or subscriber expressly or impliedly consents, 18 U.S.C. § 
2702(¢)(2); 


b) (U) The disclosure “may be necessarily incident to the rendition of the service or to the 
protection of the rights or property of the provider of that service." 18 U.S.C. § 
2702(c)(3); 


c€) (U) The provider “in good faith. believes that an emergency involving danger of death 
or serious physical injury to any person requires disclosure without delay of information 
relating to the emergency,” 18 U.S.C. § 2702(c)(4): or 


d) (U/AFOHO) Note: An emergency disclosure under this statutory exception is justified 
when the ci tances demand immediate action (i.c., obtaining/disclosing 
information "without delay") to prevent death or serious bodily injury; the statute does 
not depend on the immediacy of the risk of danger itself. For example, an c-mail that 
discusses a planned terrorist attack but not the timing of the attack would constitute an 
emergency that threatens life or limb and requires immediate action, even though the 
timing of the attack is unknown. It is the need for immediate action to prevent the 
serious harm threatened rather than the immediacy of the threat itself that provides the 
justification for voluntary disclosures under this exception. H.R Rep. No. 107-497 at 
13-14 (2002) accompanying The Cyber Security Enhancement Act of 2002, H.R. 3482, 
which passed as part of the comprehensive Homeland Security Act of 2002, Pub. L. No. 
107-296, § 225 116 Stat. 2135 (2002). 


e) (U) The disclosure is to the National Center for Missing and Exploited Children, in 
connection with a report submitted thereto under Section 227 of the Victims of Child 
Abuse Act of 1990. (42 U.S.C. § 13032 and 18 U.S.C. § 2702[c][5)) 
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BIE 


bIE 


A governmental entity is authorized to direct providers to 
preserve stored records and communications pursuant to 18 U.S.C. § 2703(f). Once a 
preservation request is made, ECPA requires that the provider must retain the records 
for 90 days, renewable for another 90-day period upon a government request. See 18 
U.S.C. § 2703 (f)(2). 


b) (U) There is no legall 


b7E 


c) (U) FBI employees who send 18 U.S.C. § 2703(f) letters to network service providers 
should be aware of two limitations. First, the authority to direct providers to preserve 
records and other evidence is not prospective. Thus. 18 U.S.C. § 2703(f) letters can 
order a provider to preserve records that have already been created but cannot order 
providers to preserve records not yet made. If FBI employees want providers to record 
information about future electronic communications, they must comply with the 
electronic surveillance statutes. A second limitation of 18 U.S.C. § 2703¢f) is that some 
providers may be unable to comply effectively with 18 U.S.C. § 2703(f) requests 
bIE 


4) (U) Video Tape Rental or Sales Records - 18 U.S.C. § 2710 makes the unauthorized 
disclosure of records by any person engaged in the rental, sale, or delivery of prerecorded 
video cassette tapes or similar audiovisual materials unlawful and provides an exclusionary 
rule to prohibit personally identifiable information otherwise obtained from being 
admissible as evidence in any court proceeding. Personally identifiable information is 
defined information that identifies a person as having requested or obtained specific 
video material or services ....” 


a) (U) The disclosure to law enforcement of “personally identifiable information” is 
permitted only when the law enforcement agency: 


(i) (U) Has the written consent of the customer; 


(ii) (U) Obtains a search warrant issued under Rule 41, FRCP or equivalent state 
warrant; or 


(iii) (U) Serves a grand jury subpoena; 


oF 
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c) (U) This type of information was specifically not included in the definition of 
"personally identifiable information” to allow law enforcement to obtain information 
about individuals during routine investigations such as neighborhood investigations. 


d) (UFOUC} The disclosure of “personally identifiable information” in a national 
security investigation may be compelled through use of the above legal processes or 
pursuant to a business records order issued under 50 U.S.C. § 1861. 
18.6.8.5 (U) VOLUNTARY EMERGENCY DISCLOSURE 
18.6.8.5.1 (U) SCOPE 


(UFOO) ECPA protects subscriber and transactional information regarding 
communications from disclosure by providers of remote computing services or telephone or 
other electronic communication services to the public (remote computing services, telephone 
and other clectronic communications services are hereafter collectively referred to as 
“electronic communications service providers” or “providers”). Generally, an NSL. grand jury 
subpoena, or other form of legal process must be used to compel the communication service 
rovider to disclose such information. BIE 


(U/TFOUS) b7E 
(U/FOGO} PIR 
U/Feua g 
(U//FOB9) The use ormel Jis designed to captures all the information the FBI iia 
needs to satisfy statutory annual Congressional reporting requirements. 

U/EOUS) DIR: 
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18.6.8.5.2 (U) DURATION OF APPROVAL 


(U) As authorized by statute (e.g.. for as long as the emergency necessitating usage exists and 
only in those circumstances when it is impracticable to obtain other legal process such as a 
subpoena or NSL) and applicable court order or warrant. 


18.6.8.5.3 (U) SPECIFIC PROCEDURES 
A) UAFOHO) Required Form: 


B) (U//FOUO) Filing requirements: 


C) (U//POHO) Contact with Providers: 


18.6.8.5.4 (U) COST REIMBURSEMENT 


(U) Policy and procedures regarding cost reimbursement are described in the following: 


A) (U) Standardized payment procedures may be found in hf |] 


can also be found in 18 U.S.C. § 
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18.6.8.5.5 (U) REPORTING VOLUNTARY EMERGENCY DISCLOSURES 


(U) 18 U.S.C. § 2702(d) requires the Attorney General to report annually to Congress 
information pertaining to the reccipt of voluntary disclosures of the contents of stored wire or 
electronic communications in an emergency under 18 U.S.C. § 2702(b)(8), specifically: 


A) (U) The number of accounts from which the FBI received voluntary emergency disclosures; 
and 


B) (U) A summary of the basis for the emergency disclosure in those investigations that were 
closed without the filing of criminal charges. 


(U) m|] Form will capture information required to meet these reporting requirement. 


18.6.8.5.6 (U) ROLES/RESPONSIBILITIES 


(U) ener hosts theL___ form will. when necessary. follow- 
up with e-mail notifications to the issuing employcc to ensure that the information included in 


the report to DOJ (which it uses to prepare the required Congressional report) is current. It is 
the responsibility of the FB] employee to respond to these requests for information as soon as 
practicable but no later than ten (10) business days. Failure to do so may be considered 
“substantial non-compliance” pursuant to Section 3 


(U) OGC/ILB is assigned the administrative responsibility to complete the following by 
December 31 of cach year: 


A) (U) Tabulate the number of voluntary disclosures of stored contents received under the 
authority of 18 U.S.C. § 2702(b)(8) for the calendar year; 


B) (U) Prepare a report summarizing the basis for disclosure in thosc instances in which the 
relevant investigation was closed without the filing of criminal charges; and 


C) (U) Submit the report to the General Counsel for review and submis 
the statutory requirement for annual report by the Attorney General. 


on to DOJ according to 
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18.6.9 (U) INVESTIGATIVE METHOD: PEN REGISTERS AND TRAP/TRACE 
DEVICES (PR/TT) 


18.6.9.1 (U) SUMMARY 


(U) Pen register and trap and trace (PR/TT) devices enable the prospective collection of non- 
content traffic information associated with wire and electronic communications, such as: the 
phone numbers dialed from or to a particular telephone, including electronic communications; 
messages sent from or to a particular telephone; or the internet protocol (IP) address of 
communications on the Internet and other computer networks. 


18.6.9.2 (U) APPLICATION 
U/FOUS 


18.6.9.3 (U) LEGAL AUTHORITY 


(U) 18 U.S.C. §§ 3121 ct seq. and 50 U.S.C. §§ 1842 ct seq. regulate the use of PR/TT 
devices. PR/TT orders authorize the collection of phone number dialed from or to a particular 
telephone, IP addresses, port numbers and the “To” and “From” information from e-mail; they 
cannot intercept the content of a communication, such as telephone conversations or the 
words in the “subject line” or the body of an e-mail. 


18.6.9.4 (U) DEFINITION OF INVESTIGATIVE METHOD 
(U) A pen register device or process records or decodes dialing. routing. addressing or 
signaling information transmitted by an instrument or facility from which a wire or electronic 
communication is transmitted, provided that such information must not include the contents of 
any communication. See 18 U.S.C. § 3127(3). 
(U) A trap and trace device or process captures the incoming electronic or other impulses that 
identify the originating number or other dialing. routing, addressing or signaling information 
reasonably likely to identify the source of a wire or electronic communication, provided that 
such information does not include the contents of any communication. See 18 U.S.C. § 
3127(4). 

18.6.9.5 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR INVESTIGATIVE 

METHOD 


18.6.9.5.1 (U) PEN REGISTER/TRAP AND TRACE UNDER FISA 


(U) Applications for authority to use a PR/TT device can be made to the FISC in national 
security investigations. See 50 U.S.C. § 1842. 


COMP) 
SSS ee 
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BIE 


(U) 28 C.F.R. § 50.10(b)(1)(ii) provides guidance on categories of individuals and entities 
not covered by. and therefore not entitled to the protections of the DOJ policy set out above. 


18.6.9.5.1.1 (U) LEGAL STANDARD 
(U) Applications to the FISC are to be under oath and must include: 
A) (U) The identity of the federal officer making the application; and 


B) (U) A certification by the applicant that the information likely to be obtained is foreign 
intelligence information not concerning an USPER or is information that is relevant to an 
ongoing investigation to protect the United States against international terrorism or clandestine 
intelligence activities; and that such investigation, if of an USPER, is not conducted solely 
upon the basis of activities protected by the First Amendment to the Constitution. 


18.6.9.5.1.2 (U) PROCEDURES 
(U/ROHO) Requests for initiating or a renewal of FISA PR/TT must be made using bIE 


Routing a paper copy for signatures is not required. 


(UUROBETSee[  ___—_—_______ ë ëO] 
Lior additional guidance. b7E 


18.6.9.5.1.3 (U) EMERGENCY ALTHORITY—FISA: 50 U.S.C. § 1843 


(U/FƏ¥89) Under the provisions of FISA, the Attorney General may grant Emergency 
Authority (EA) for PR/TT. Requests for Emergency Authority must be referred to the 
appropriate FBIHQ division. 


(U/FOUO SIE 


A) (U) The Attorney General may authorize the installation and use of a PR/TT upon a 
determination that an emergency exists and that the factual basis exists for a court order. The 
FISC must be informed at the time of the authorization and an application for a court order 
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must be made to the court as soon as practicable, but no more than seven (7) days after the 
authorization. If the court does not issue an order approving the use of a PR/TT, an 
emergency-authorized PR/TT use must terminate at the carliest of when the information 
sought is obtained. when the FISC denies the application, or seven (7) days after the Attorney 
Gencral authorization is given. 


B) (U) If the FISC denies the application after an emergency PR/TT device has been installed, no 
information collected as a result may be used in any manner, except with the approval of the 
Attorney General upon a showing that the information indicates a threat of death or serious 
bodily harm to any person. 


(U) Notwithstanding the foregoing, the President. acting through the Attorney General. 
may authorize the use of a PR/TT. without a court order, for a period not to exceed 15 
calendar days. following a declaration of war by Congress. See 50 U.S.C. § 1844. 


(U/F6¥6) For an emergency authorization to use a PR/TT surveillance, 


18.6.9.5.1.4 (U) FISA OVERCOLLECTION 


(U//FOUSO) In accordance with Foreign Intelligence Surveillance Court (FISC) Rule of 
Procedure 15. information acquired outside of the scope of the FISA authorization 
(“FISA overcollection”) will no longer be sequestered with the FISC, absent 
extraordinary circumstances. Contact NSLB for further guidance regarding the handling 
of any FISA overcollection. 


18.6.9.5.2 (U) CRIMINAL PEN REGISTER/TRAP AND TRACE UNDER TITLE 18 


(U) Applications for the installation and use of a PR/TT device may be made to a “court of 
competent jurisdiction”—i.e., “any district court of the United States (including a magistrate 
judge of such a court) or any United States court of appeals having jurisdiction over the 
offense being investigated, or any court of gencral criminal jurisdiction of a State authorized 
by the law of that State to enter orders authorizing the use of a pen register or trap and trace 
device.” See 18 U.S.C. § 3127(2) 


ii) provides guidance on categorics of individuals an 
entities not cavered by. and therefore not entitled to the protections of the DOJ policy set out 
above. 


18.6.9.5.2.1 (U) LEGAL STANDARD 


(U) Applications for authorization to install and use a PR/TT device must include: 
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A) (U) The identity of the attomey for the government or the state law enforcement or 
investigative officer making the application and the identity of the law enforcement agency 
conducting the investigation; and 


B) (U) A certification by the applicant that the information likely to be obtained is relevant to an 
ongoing criminal investigation being conducted by that agency. 


18.6.9.5.2.2 (U//FOUO} PROCEDURES 


(U//F@UO) An SSA must approve a request for initiating or renewal of PR/TT use prior 
to submission of the request to an attorney for the government. Before approving such a 
request, the SSA should consider of the following: 


A) (U//FOUS) The use of resources based on the investigative purpose set forth; 

B) (U/FFE0O) Whether there is sufficient factual basis for the certification to be made in the 
application (i.c., is the information likely to be obtained relevant to an ongoing criminal 
investigation); 

C) (U/F@HO} Whether the customer or subscriber has consented to the use of a PR/TT, see 18 
U.S.C. § 3121(b)(3); or 


D) (U/AF@tS) Whether the use of a PR/TT is the Icast intrusive method if reasonable based upon 
the circumstances of the investigation. 


(U/FEHO) A copy of the approving EC must be maintained in the pen register sub-file 
“PEN” 


(U//FORO) A PR/TT order is executable anywhere within the United States and, upon 
service, the order applies to any person or entity providing wire or clectronic 
communication service in the United States whose assistance may facilitate the execution 
of the order. 


cuimorse) seo 


for additional guidance. 
18.6.9.5.2.3 (U) EMERGENCY AUTHORITY—CRIMINAL: 18 U.S.C. § 3125 


(U) The Attorney General. the Deputy Attorney General, the Associate Attorney General, 
any Assistant Attorney General, any acting Assistant Attorney General, or any Deputy 
Assistant Attorney Gencral may specially designate any investigative or law enforcement 
officer to reasonably determine whether an emergency situation exists that requires the 
installation and use of a PR/TT device before an order authorizing such installation and 
use can, with due diligence, be obtained and there are grounds upon which an order could 
be entered authorizing the installation and use of a PR/TT. 


(U) An emergency situation as defined in this section involves: 

A) (U) Immediate danger of death or serious bodily injury to any person; 
B) (U) Conspiratorial activities characteristic of organized crime; 

C) (U) An immediate threat to a national security interest; or 


D) (U) An ongoing attack on a protected computer {as defined in 18 U.S.C. § 1030) that 
constitutes a crime punishable by a term of imprisonment greater than onc year. 
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(U) Only DOJ officials have the authority to authorize the emergency installation of a 
PR/TT. The FBI does not have this authority. If the DOJ authorizes the emergency 
installation of a PR/TT. the government has 48 hours after the installation to apply for 
and obtain a court order according to 18 U.S.C. § 3123. It is a violation of law to fail to 
apply for and obtain a court order within this 48 hour period. Use of the PR/TT shall 
immediately terminate when the information sought is obtained. when the application for 
a court order is denied, or if no court order has been obtained 48 hours after the 
installation of the PR/TT device in emergency situations. 


b7E 
(U/FSB9) As with requesting authorization for an emergency Title III. 


Once that 
attorney will advis at The emergency 
use has been approved and that the law enforcement agency may proceed with the 
installation and use of the PR/TT. The DOJ attorney will send a verification 
memorandum, signed by the authorizing official. to the AUSA. The AUSA will include 
an authorization memorandum with the application for the court order approving the 
emergency use. 


bIE 


18.6.9.6 (U) DURATION OF APPROVAL 


A) (U) FISA: The use of a PR/TT device may be authorized by the FISC for a period of time not 
to exceed 90 days in investigations targeting an USPER. Extensions may be granted for 
periods not to exceed 90 days upon re-application to the court. In investigations in which the 
applicant has certified that the information likely to be obtained is foreign intelligence 
information not concerning a U.S. person (USPER), an order or extension may be for a period 
of time not to exceed one year. 


B) (U) Criminal: The installation and use of a PR/TT device may be authorized by court order 
under 18 U.S.C. § 3123 for a period not to exceed 60 days. which may be extended for 
additional 60-day periods. 


18.6.9.7 (U) SPECIFIC PROCEDURES 


(U//FOUS) Prior to installing and using a PR/TT device (whether issued in a criminal or 
national security matter), the case agent must: 


A) U/FORR bIE 
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18.6.9.8 (U) USE OF FISA DERIVED INFORMATION IN OTHER PROCEEDINGS 


(U/#FOUO) There are statutory (50 U.S.C. Sections 1806. 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency. regulatory body. or other 
authority of the United States. . . .” See DIOG Appendix E for the AG Memo, Revised 
Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strict] 


followed. Though not contained in the AG Memo. FBI policy requires TA bIE 
po Gis concerning the FISA use policy or 


requests for assistance in obtaining FISA use authority from the AG should be directed to 
NSLB’s Classified Litigation Support Unit 


(U//FOUO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1801(k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806{c), 1825(d). and 1845{c). 


18.6.9.9 (U) CONGRESSIONAL NOTICE AND REPORTING REQUIREMENTS 
18.6.9.9.1 (U) CRIMINAL PEN REGISTER/TRAP AND TRACE- ANNUAL REPORT 


(U) The Attorney General is required to make an annual report to Congress on the number of 
criminal PR/TT orders applied for by DOJ law enforcement agencies. See 18 U.S.C. § 3126. 
The report must include the following information: 


A) (U) The period of interceptions authorized by the order, and the number and duration of any 
extensions; 


B) (U) The offense specified in the order or application, or extension; 
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C) (U) The number of investigations involved; 
D) (U) The number and nature of the facilities affected; and 


E) (U) The identity, including the district, of the applying agency making the application and the 
person authorizing the order. 

(U/FGUS) DOJ. Criminal Division. OEO requires the FBI to provide quarterly reports on 
pen register usage. To satisfy DOJ data requirements and standardize and simplify field 
reporting, court-ordered pen register usage must be reported to FBIHQ 

within five (5) workdays alter the 
expiration date of an original order and any extensions, or denial of an application for an 
order. For all criminal PR/TT orders or extensions issued on or after January 1, 2009. the 

hese reporting requirements 

do not apply to PR/TT authorized pursuant to consent or under the provisions of FISA. 


18.6.9.9.2 (U) NATIONAL SECURITY PEN REGISTERS AND TRAP AND TRACE — SEMI- 
ANNUAL REPORT 


(U) The Attorney General must inform the House Permanent Select Committee on 
Intelligence. Senate Select Committee on Intelligence. Committee of the Judiciary of the 
House Representatives, and Committee of the Judiciary of the Senate concerning all uses of 
PR/TT devices pursuant to 50 U.S.C. § 1846. This report is coordinated through DOJ NSD. A 
semi-annual report must be submitted that contains the following information: 


A) (U) The total number of applications made for orders approving the use of PR/TT devices; 
B) (U) The total number of such orders either granted. modified, or denied; and 


C) (U) The total number of PR/TT devices whose installation and use was authorized by the 
Attorney General on an emergency basis and the total number of subsequent orders approving 
or denying the installation and usc of such PR/TT devices. 


18.6.9.10 (U) Post CUT-THROUGH DIALED DIGITS (PCTDD) 
18.6.9.10.1 (U) OVERVIEW 


(U//FO8O} Telecommunication networks provide users the ability to engage in extended 
dialing and/or signaling (also known as "post cut-through dialed digits" or PCTDD), which in 
some circumstances are simply call-routing information and, in others, are call content. For 
example. non-content PCTDD may be generated when a party places a calling card, credit 
card. or collect call by first dialing a long-distance carricr access number and then, after the 
initial call is “cut through,” dialing the telephone number of the destination party. In other 
instances, PCTDD may represent call content, such as when a party calls an automated 
banking service and enters an account number, calls a pharmacy’s automated prescription 
refill service and enters prescription information, or enters a call-back number when prompted 
by a voice mail service. See United States Telecom Assn v. Federal Communications 
Commission, 227 F.3d 450, 462 (D.C. Cir. 2000). 


(U//FEU6) The definition of both a pen register device and a trap and trace device provides 
that the information collected by these devices "shall not include the contents of any 
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communication.” See 18 U.S.C. § 3127(3) and (4). In addition. 18 U.S.C. § 3121{c) makes 
explicit the requirement to "use technology reasonably available” that restricts the collection 
of information "so as not to include the contents of any wire or electronic communications.” 
“Content” includes any information concerning the substance. purport. or meaning of a 
communication. See 18 U.S.C. § 2510(8). When the pen register definition is read in 
conjunction with the limitation provision. however, it suggests that although a PR/TT device 
may not be used for the express purpose of collecting content, the incidental collection of 
content may occur despite the use of "reasonably available” technology to minimize, to the 
extent feasible, any possible over collection of content while still allowing the device to 
collect all of the dialing and signaling information authorized. 


(U/FEHO) DOJ Policy: In addition to this statutory obligation, DOJ has issued a directive in 

to all DOJ agencies requiring that no 
affirmative investigative use may be made of PCTDD incidentally collected that constitutes 
content, except in cases of emergency—to prevent an immediate danger of death, serious 
physical injury, or harm to the national security. 


(UPFOUO) 


18.6.9.10.2 (U) COLLECTION OF PCTDD 
(UFOO 


A) CU/FOUS) 


B) (U/Æ699) 


18.6.9.10.3 (U) USE oF PCTDD 
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B) (U/FOWO) 


1) U//FEYO 


2) (UFOO; 
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18.6.9.10.4 (U) WHAT CONSTITUTES PCTDD CONTENT 


(U//FEUO) In applying the above, the term “content” is interpreted to mean “any information 
concerning the substance. purport, or meaning of a communication” as defined in 18 U.S.C. § 
2510. Questions concerning whether specific PCTDD are content as opposed to dialing, 
routing, addressing. or signaling information should be addressed to the CDC or OGC for 
coordination with DOJ as necessary. 


(UFOO) b7E 


18.6.9.11  (U/ b7E 


vmd ooo l 


{Scc also guidance provided in the OTD Technology- 


18.6.9.11.1 (UVFOUO) To LOCATE A KNOWN PHONE NUMBER 
A) (U/FOUO) Authority: A standard PR/TT order issued pursuant to 18 U.S.C. § 3127 is 


adequate to authorize the use of this technology to determine the location of a known targeted 
phone, provided that the language authorizes FBI employces to install or cause to be installed 
and use a pen register device, without geographical limitation, at any time of day or night 
within (X) days from the date the order is signed, to record or decode dialing, routing, 
addressing. or signaling information transmitted by the “Subject Telephone.” Due to varying 
and often changing court interpretations of the requirements for obtaining cell site location 
information, agents contemplating legal process to obtain such information should consult as 

ry with their CDC and/or AUSA for the legal requirements in their particular 

tion. The application and order should generally also request authority to compel 

tion data on an ongoing ba: 


bIE 


bIE 
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Under Kyllo v. United States. 533 U.S. 27 (2001), the use of equipment 


not in general public | use to acquire data that is not otherwise detectable that emanates from a 


(UHFOUO) To IDENTIFY AN UNKNOWN TARGET PHONE NUMBER 


(UFOO) Authority: 


(U/FOBO} 
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BIE 


A) (U/FORS) b7E 


B) (U/ FOUC b7E 


18.6.9.11.3. (U) PR/TT ORDER LANGUAGE 


(U) The language in the order should state that "the pen register will be implemented 
unobtrusively and with minimum interference with the services accorded to customers of 
such service.” 

18.6.9.12 (U) EVIDENCE HANDLING 


(UFOO) All ELSUR downloading, processing, and handling of original, derivative. and 

copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 

technician (EOT) or other designated employee (e.g. an agent who has successfully completed 

ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded intol_____] b7E 
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18.6.10 (U) INVESTIGATIVE METHOD: MAIL COVERS 
18.6.10.1  (U)SUMMARY 


(U) A mail cover may be sought only in a Predicated Investigation when there are reasonable 
grounds to demonstrate that the mail cover is necessary to: (i) protect the national security; (ii) 
locate a fugitive; (iii) obtain evidence of the commission or attempted commission of a 
federal crime; or (iv) assist in the identification of property, proceeds or assets forfeitable 
because of a violation of criminal law. See 39 C.F.R. § 233.3(ce)(2). 


(U) b7E 


18.6.10.2 (U) APPLICATION 
(U/FOUO) b7E 


18.6.10.3. (U) LEGAL AUTHORITY 


A) (U) Postal Service Regulation 39 C.F.R. § 233.3 is the sole authority and procedure for 
opening a mail cover and for processing, using and disclosing information obtained from a 
mail cover; 


B) (U) There is no Fourth Amendment protection for information on the outside of a piece of 
mail. See, e.g.. U.S. v. Choate, 576 F.2d 165. 174 cg" Cir.. 1978); and U.S. v. Huie, 593 F.2d 
14 (5" Cir.. 1979); and 


C) (U) AGG-Dom, Part V.A.2. 
18.6.10.4 (U) DEFINITION OF INVESTIGATIVE METHOD. 
(U) A mail cover is the non-consensual recording of any data appearing on the outside cover 
of any sealed or unsealed mail matter to obtain information in order to: 
A) (U) Protect the national security; 
B) (U) Locate a fugitive; 
C) (U) Obtain evidence of commission or attempted commission of a federal crime; 


D) (U) Obtain evidence of a violation or attempted violation of a postal statute; or 


18-152 
UNCLASSIFIED — FOR GFPFICIAEESE-ONLY 


Version Dated: 
March 3, 2016 


UNCLASSIFIED - FOR-OFFICTALUSE-ONEY 
Domestic Investigations and Operations Guide §18 
E) (U) Assist in the identification of property, proceeds or assets forfeitable under law. 
See 39 C.F.R. § 233.3¢c) (1). 

(U) In this context, a “recording” means the transcription, photograph, photocopy, or other 
facsimile of the image of the outside cover. envelope. or wrapper of mailed matter. A warrant 
or court order is almost always required to obtain the contents of any class of mail, sealed or 
unsealed. 

18.6.10.5 | (U) STANDARD FOR USE AND APPROVAL REQUIREMENTS FOR INVESTIGATIVE 

METHOD 


(UFFOUO) Required Form: 


Resources t 


(U/FORO) Criminal Mail Cover. 


(U/FOUO) Required Form: 
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(U/BOUO) Review and Approval of National Security or Criminal Mail Cover Requests: 


Approval of any mail cover request or extension is conditioned on the following criteria being 


met: 


A) (UFOO) 


B) (U/POUS) 


F) (UFO) 


D 


nder postal 


regulations, a mail cover must not include matter mailed between the mail cover subject and 
the subject's attorney, unless the attorney is also a subject under the investigation. 


—S 


U. 
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(U) Emergency Requests: When time is of the essence. the Chief Postal Inspector (or 
designee at National Headquarters) or after delegation. in criminal mail cover requests, the 
Criminal Investigations Service Center Manager (or designee), or the local Inspector in 
Charge. may act upon an oral request to be confirmed by the requesting agency, in writing. 
within three calendar days. Information may be released prior to receipt of the written request 
only when the releasing official is satisfied that an emergency situation exists. See 39 C.F.R. § 
233.3(c)(3). 


(U) An “emergency situation” exists when the immediate release of information is required to 
prevent the loss of evidence or when there is a potential for immediate physical harm to 
persons or property. See 39 C.F.R. § 233.3(c)(10). 


18.6.10.6 (U} DURATION OF APPROVAL 


A) (U) National Security Mail Coyers: No national security mail cover may remain in force for 
longer than 120 continuous days unless personally approved for further extension by the Chicf 
Postal Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 


B) (U) Criminal Mail Covers Except Fugitives: A mail cover in a criminal investigation is 
limited to no more than 30 days, unless adequate justification is provided by the requesting 
authority. See 39 C.F.R. § 233.3(g)(5). Renewals may be granted for additional 30-day 
periods, up to the maximum of 120 days, under the same conditions and procedures applicable 
to the original request. The requesting authority must provide a statement of the investigative 
benefit of the mail cover and anticipated benefits to be derived from the extension. 


C) (U) Fugitives: No mail cover instituted to locate a fugitive may remain in force for longer 
than 120 continuous days unless personally approved for further extension by the Chief Postal 
Inspector or his/her designees at National Headquarters. See 39 C.F.R. § 233.3(g)(6). 


D) (U) Exception for Indictments and Information: Except for fugitive investigations, no mail 
cover may remain in force when an information has been filed or the subject has been indicted 
for the matter for which the mail cover has been requested. If the subject i is under investigation 
for further criminal violations, or a mail cover is required to assist in the identification of 
property, proceeds or assets forfeitable because of a violation of criminal law, a new mail 


b7E 


18.6.10.7 (U) STORAGE OF MAIL COVER INFORMATION 


(U//FEGS) The Postal Regulation requires that physical storage of all reports issued pursuant 
to a mail cover request to be at the discretion of the Chief Postal Inspector. See 39 C.F.R. § 
233.3(h)(1). Accordingly. FBI employces must conduct a timely review of mail cover 
documents reccived from the USPS. A copy of the signed mail cover request and the signed 
transmittal letter must be maintained in the investigative file. 


18.6.10.8 (U) RETURN OF MAIL COVER INFORMATION TO USPS 
(U//FOHO) BIE 
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18.6.10.9 (U) COMPLIANCE AND MONITORING 


(U/F66} FBI employees must conduct a timely review of mail cover information received 
from the USPS for any potential production of data beyond the scope of the requested mail 
cover (“overproduction”). Overproduced information from a mail cover must not be serialized 
into any FBI database or used in any manner. 


A) U/F66) Criminal Mail Cover — Overproduction: 


B) (U/FOU0) National Security Mail Cover — Overproduction: 
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18.6.11 (U) INVESTIGATIVE METHOD: POLYGRAPH EXAMINATIONS 


18.6.11.1  (U} SUMMARY 


(U//FƏ89) The polygraph examination is used in Predicated Investigations to: (i) aid in 
determining whether a person has pertinent knowledge of a particular matter under 
investigation or inquiry; (ii) aid in determining the truthfulness of statements made or 
information furnished by a subject, victim. witness, CHS. or an individual making allegations; 
and (iii) obtain information Icading to the location of evidence, individuals or sites of offense. 


(UFO 


(U/FO66) This policy docs not limit other authorized uses of polygraph method outside of 
Assessments or Predicated Investigations, such as the FBI’s responsibilities to conduct 
background checks and inquiries concerning applicants and employees under federal 
personnel security programs. 


18.6.11.2  (U) APPLICATION 


18.6.11.3. (U) LEGAL AUTHORITY 
(U) AGG-Dom. Part V.A.6. 


18.6.11.4 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR INVESTIGATIVE 
METHOD 


(U//FOGO) An SSA may approve the use of a polygraph if: 


A) curevof__ ëO 


d> psf o SSN 


o we o S 
b= 


18.6.11.5 (U) DURATION OF APPROVAL 


——— 
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18.6.11.6 (U) SPECIFIC PROCEDURES 


(U/4BQU9) An EC must be prepared requesting SSA approval for the polygraph. If an AUSA 
is assigned to the investigation, an FBI employee must confer with the USAO to discuss any 
prosecutorial issues prior to the administration of a polygraph. 


18.6.11.7 (U) COMPLIANCE AND MONITORING 


(U//FE¢SO) All polygraphs conducted in Predicated Investigations must be documented in the 
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18.6.12 (U) INVESTIGATIVE METHOD: SEARCHES THAT DO NOT REQUIRE A 
WARRANT OR COURT ORDER| 


NVENTORY SEARCHES GENERALLY 
18.6.12.1 (U)SUMMARY 


(U) The Fourth Amendment to the United States Constitution prevents the FBI from 
conducting unreasonable searches and seizures. It also generally requires a warrant be 
obtained if the search will intrude on a reasonable expectation of privacy. To qualify as a 
“reasonable expectation of privacy,” the individual must have an actual subjective expectation 
of privacy and socicty must be prepared to recognize that expectation as objectively 
reasonable. See Katz v. United Sta 389 U.S. at 361. If an individual has a reasonable 
expectation of privacy, a warrant or order issued by a court of competent jurisdiction or an 
exception to the requirement for such a warrant or order is required before a scarch may be 
conducted. Physical searches of personal or real property may be conducted without a search 
warrant or court order if there is no reasonable expectation of privacy in the property or area. 
As a general matter, there is no reasonable expectation of privacy in areas that are exposed to 
public view or that are otherwise available to the public. 


(U//FOO) Note: Consent Searches are authorized in Assessments, as well as in Predicated 
Investigations. 


(U) A reasonable expectation of privacy may be terminated by an individual abandoning 
property, sctting trash at the edge of the curtilage or beyond for collection, or when a private 
party reveals the contents of a package (Sce DIOG subsection 18.6.12.4.2. However, the 
AGG-Dom an i yi i kii vers” i 

Investigations. 


18.6.12.2 (U) APPLICATION 
(U//FOU85| 


Us 


(U/FOEO) 


18.6.12.3 (U) LEGAL AUTHORITY 
A) (U) AGG-Dom, Part V.A.3, 
B) (U) Fourth Amendment to the United States Constitution 
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18.6.12.4  (U) DEFINITION OF INVESTIGATIVE METHOD 


18.6.12.4.1 (U) DISTINCTION BETWEEN A TRASH COVER, A SEARCH OF ABANDONED 
PROPERTY IN A PUBLIC RECEPTACLE, AND ADMINISTRATIVE INVENTORY 
SEARCH" OF A LOST OR MISPLACED ITEM 


A) (UF Trash Coyer: 


A trash cover is a targeted effort to gather information 
regarding a particular person or entity by reviewing that person or entity's refuse. Generally, a 
trash cover is planned in advance based upon information indicating that a specific trash 
container will contain evidence or intelligence of an investigative interest within a specified 
period of time. 


If, for example, an FBI employee 


value in any public trash receptacle. the FBI employee may recover the item(s) without having 
an Assessment or Predicated Investigation open at that time. 


C)_(U/FOYO) 


D) (U 


(U) m 
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18.6.12.4.2 (U) DETERMINATION OF AN AREA OF CURTILAGE AROUND A HOME 


(U) Whether an area is curtilage around a home is determined by reference to four factors: (i) 
proximity of the area in question to the home; (ii) whether the area is within an enclosure 
surrounding the home; (iii) nature of the use to which the area is put; and (iv) steps taken to 
protect the area from observation by passers-by. 


(U) An area is curtilage if it is so intimately tied to the home itself that it should be placed 
under the home’s umbrella of Fourth Amendment protection. 


18.6.12.5 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR A TRASH 
COVER 


(U/TFOUO) SSA approval is required for the use of a trash cover. In Type 5 Assessments. 
prior to using a trash cover. the employee must also consult with the CDC or OGC to 
determine whether the search implicates a reasonable expectation of privacy and thus requires 
a search warrant. During Predicated Investigations, if there is a doubt as to whether a person 
has a reasonable expectation of privacy in the arca to be searched, the employee must consult 
with the CDC or OGC to determine whether a search warrant is required. Use of this method 
must be documented in the investigative file. 
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(U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS RETRIEVAL OF 
DISCARDED OR ABANDONED PROPERTY, ADMINISTRATIVE SEARCHES OF 
LOST OR MISPLACED PROPERTY AND INVENTORY SEARCHES GENERALLY 
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18.6.13 (U) INVESTIGATIVE METHOD: UNDERCOVER OPERATIONS 
18.6.13.1 (U) SUMMARY 
Us 


(U/FO69) Undercover operations must be conducted in conformity with The Attorney 
General’s Guidelines on Federal Bureau of Investigation Undercover Operations (AGG- 
UC) in investigations relating to activities in violation of federal criminal law that do not 
concern threats to the national security or foreign intelligence. In investigations that concern 
threats to the national security or foreign intelligence, undercover operations involving 
religious or political organizations must be reviewed and approved by FBI Headquarters, with 
participation by the NSD in the review process. (AGG-Dom, Part V.A.7) Other undercover 
operations involving threats to the national security or foreign intelligence are reviewed and 
approved pursuant to FBI policy as described herein. 


18.6.13.2 (U) LEGAL AUTHORITY 
A) (U) AGG-Dom, Part V.A.7 
B) (U) AGG-UCO 
18.6.13.3. (U) DEFINITION OF INVESTIGATIVE METHOD 
A) U//FECO) Undercover Activi 


B) U/FOLD) 


C) (U/FOUO) Undercover Operation: 


18-163 


Version Dated: 
UNCLASSIFIED — FOR OFFICIAL CSE-ONEY March 3, 2016 


b6 
b7C 


b7E 


b7E 


b7E 


UNCLASSIFIED — FOR-OFFICHAL-GSE-ONEY 


Domestic Investigations and Operations Guide §18 
b7E 
18.6.13.3.1_ (U) DISTINCTION BETWEEN SENSITIVE CIRCUMSTANCE AND SENSITIVE 
INVESTIGATIVE MATTER 
bIE 


in the AGG-UCO and the 


USOPG and for national security matters in the NSUCOPG | 


The detailed policy for undercover operations is described in this section of 
the DIOG, the USGPG, the NSUCGPG, and the FBIHQ operational division PGs. 


18.6.13.4 (U/H¥@EO) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR 
INVESTIGATIVE METHOD 
18.6.13.4.1 (U) STANDARDS FOR USE OF INVESTIGATIVE METHOD 


(U//FO8O} An official considering approval or authorization of a proposed undercover 
application must weigh the risks and benefits of the operation, giving careful consideration to 
the following: 


A) (U//PQUO) The risks of personal injury to individuals, property damage, financial loss to 
persons or business, damage to reputation, or other harm to persons; 


B) (U//FE86) The risk of civil liability or other loss to the government; 


C) (U/ÆQUO) The risk of invasion of privacy or interference with privileged or confidential 
relationships and any potential constitutional concerns or other legal concerns; 


D) (U//FOEG6) The risk that individuals engaged in undercover operations may become involved 
in illegal conduct; and 


E) (U//FOUD) The suitability of government participation in the type of activity that is expected 
to occur during the operation. See AGG-UCO, Part IV.A. 
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18.6.13.4.2  (U//FOGO) APPROVAL REQUIREMENTS FOR UCOS (INVESTIGATIONS OF 
VIOLATIONS OF FEDERAL CRIMINAL LAW THAT DO NOT CONCERN 
THREATS TO NATIONAL SECURITY OR FOREIGN INTELLIGENCE) 


U/FOBO 


C) (U/FOBO) 
To 
E) (U//FORO) 


ee 
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18.6.13.4.3. (U//FOU@) APPROVAL REQUIREMENTS FOR UCO: 


bTE 


SS ——— 


A) UFD EEES 


i Cn 


C) (U/FO RO) 


f the matter involves religious or political 
organizations, the review must include participation by a representative of the DOJ NSD. See 
AGC Din: Section Vian ] 


D) (U/FO88) 


5 aan m 
18.6.13.5 o ž þau IN UNDERCOVER OPERATIONS 
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» ©) bre 


U//FOUO 


18.6.13.6 (U) DURATION OF APPROVAL 


U/FECO bTE 


18.6.13.7 (U) ADDITIONAL GUIDANCE 


R) 


B) 
C) (U/FOUS) 


18.6.13.8 (U) COMPLIANCE AND MONITORING, AND REPORTING REQUIREMENTS 


U//FORS) All UCOs must provide an| sing the 
to appropriat 
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18.7 (U) AUTHORIZED INVESTIGATIVE METHODS IN FULL INVESTIGATIONS 
(U) See AGG-Dom, Part V.A.11-13. 


(U) In Full Investigations, to include Enterprise Investigations, the authorized investigative 
methods include: 


A) (U) The investigative methods authorized for Assessments. 
D 
2) (U) Records or information - FBI and DOJ. (See Section 18.5.2 


3) (U) Records or information - Other federal, state, local, tribal, or foreign government 
agency. (See Section 18.5.3) 


1) (U) Public information. (See Section } 


4) (U) On-line services and resources. (See Section 18.3.4) 
5) (U) CHS use and recruitment. (See Section §8.3.5 


6) (U) Interview or request information from the public or private entities. (See Section 


18.5.6 


7) (U) Information voluntarily provided by governmental or private entities. (See Section 


8) (U) Physical Surveillance (not requiring a court order}. (See Section 18.3.8 
B) (U) The investigative methods authorized for Preliminary Investigations. 


1) (U) Consensual monitoring of communications, including electronic communications. (See 
Section 18.6.1) 


2) (U) Intercepting the communications of a computer trespasser. (See Section 18.6.2) 


3) (U) Closed-circuit television/video surveillance, direction finders, and other monitoring 
devices. (See Section 18.6.3) 


4) (U) Administrative subpoenas. (See Section 18.6.4) 


5) (U) Grand jury subpoenas. (See Section 18 
6) (U) National Security Letters. (See Section 1 5) 
7) (U) FISA Order for business records. (See Section 18.6.7 


8) (U) Stored wire and electronic communications and transactional records. (See Section 
18.6.2)" 


9) (U) Pen registers and trap/trace devices. (See Section 18.6.9 
10) (U) Mail covers. (See Section 18.6.10 
11) (U) Polygraph examinations. (See Section 


12) (U) Trash Covers (Searches that do not require a warrant or court order). (See Section 


18.6.42 
13) (U) Undercover operations. (See Section 18.6.13) 


48 (U/ FOO) The use of Search Warrants to obtain this information in Preliminary Investigations is 
prohibited. (See DIOG Section 18,6.8.4.2.3) 
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C) (U) Searches — with a warrant or court order (reasonable expectation of privacy). (See Section 
38.7.4 below) 


D) (U) Electronic surveillance — Title III. (See Section 18.7.2 below) 


E) (U) Electronic surveillance — FISA and FISA Title VII (acquisition of foreign intelligence 
information). (See Section 18.7.3 below) 


(U//FƏ¥89) Not all investigative methods are authorized while collecting foreign intelligence as 
part of a Full Investigation. See DIOG Section 9 for more information. 
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18.7.1. (U) INVESTIGATIVE METHOD: SEARCHES — WITH A WARRANT OR COURT 
ORDER (REASONABLE EXPECTATION OF PRIVACY) 


(U) See AGG-Dom, Part V.A.12 and the Attorney General's Guidelines On Methods Of 
Obtaining Documentary Materials Held By Third Parties, Pursuant to Title II, Privacy Protection 
Act of 1980 (Pub. L. 96-440, Sec. 201 et seq.; 42 U.S.C. § 2000aa-11, et seq.). 


18.7.1.1 (U) SUMMARY 


(U) The Fourth Amendment to the United States Constitution governs all searches and 
seizures by government agents. The Fourth Amendment contains two clauses. The first 
establishes the prohibition against unreasonable searches and seizures. The second provides 
that no warrant (authorizing a search or seizure) will be issued unless based on probable 
cause. Although an unlawful search may not preclude a prosecution, it can have serious 
consequences for the government. These include adverse publicity, civil liability against the 
employee or the government and the suppression of evidence from the illegal seizure. 


(UsBOUO) Avplication 


(U) A search is a government invasion of a person’s privacy. To qualify as reasonable 
expectation of privacy, the individual must have an actual subjective expectation of privacy 
and society must be prepared to recognize that expectation as objectively reasonable. See 
Katz v. United States, 389 U.S. at 361. The ability to conduct a physical search in an area or 
situation where an individual has a reasonable expectation of privacy requires a warrant or 
order issued by a court of competent jurisdiction or an exception to the requirement for such a 
warrant or order. The warrant or order must be based on probable cause. The United States 
Supreme Court defines probable cause to search as a “fair probability that contraband or 
evidence of a crime will be found in a particular place.” Illinois v. Gates, 462 U.S. 213, 238 
(1983). A government agent may conduct a search without a warrant based on an individual’s 
voluntary consent. A search based on exigent circumstances may also be conducted without a 
warrant, but the requirement for probable cause remains. 


(U//FOUO) There are special rules that must be followed prior to obtaining a search warrant 
that might intrude upon professional, confidential relationships. 


18.7.1.2 (U) LEGAL AUTHORITY 


(U) Searches conducted by the FBI must be in conformity with FRCP Rule 41; FISA, 50 
U.S.C. §§ 1821-1829; or E.O. 12333 § 2.5. 


18-170 Version Dated: 
UNCLASSIFIED — FOR-OFFICHAE-USE-ONLY March 3, 2016 


bIE 


UNCLASSIFIED — POR-OFFICEALCSE-ONEY 
Domestic Investigations and Operations Guide §18 


18.7.1.3 (U) DEFINITION OF INVESTIGATIVE METHOD 


(U) Physical Search defined: A physical search constitutes any physical intrusion within the 
United States into premises or property (including examination of the interior of property by 
technical means) that is intended to result in the seizure, reproduction, inspection, or alteration 
of information, material, or property, under circumstances in which a person has a reasonable 
expectation of privacy. 


(U) A physical search requiring a warrant does not include: (i) electronic surveillance as 
defined in FISA or Title II; or (ii) the acquisition by the United States Government of foreign 
intelligence information from international foreign communications, or foreign intelligence 
activities conducted according to otherwise applicable federal law involving a foreign 
electronic communications system, using a means other than electronic surveillance as 
defined in FISA. 


18.7.1.3.1  (U) REQUIREMENT FOR REASONABLENESS 


(U) By the terms of the Fourth Amendment, a search must be reasonable at its inception and 
reasonable in its execution. 


18.7.1.3.2 (U) REASONABLE EXPECTATION OF PRIVACY 


(U) The right of privacy is a personal right, not a property concept. It safeguards whatever an 
individual reasonably expects to be private. The protection normally includes persons, 
residences, vehicles, other personal property, private conversations, private papers and 
records. The Supreme Court has determined that there is no reasonable expectation of privacy 
in certain areas or information. As a result, government intrusions into those areas do not 
constitute a search and, thus, do not have to meet the requirements of the Fourth Amendment. 
These areas include: (i) open fields; (ii) prison cells; (iii) public access areas; and (iv) vehicle 
identification numbers. The Supreme Court has also determined that certain governmental 
practices do not involve an intrusion into a reasonable expectation of privacy and, therefore, 
do not amount to a search. These practices include: (i) aerial surveillance conducted from 
navigable airspace; (ii) field test of suspected controlled substance; and (iii) odor detection. A 
reasonable expectation of privacy may be terminated by an individual taking steps to 
voluntarily relinquish the expectation of privacy, such as abandoning property or setting trash 
at the edge of the curtilage or beyond for collection. 


18.7.1.3.3 (U) ISSUANCE OF SEARCH WARRANT 


(U) Under FRCP Rule 41, upon the request of a federal law enforcement officer or an attorney 
for the government, a search warrant may be issued by: 


A) (U) a federal magistrate judge, or if none is reasonably available, a judge of a state court of 
record within the federal district, for a search of property or for a person within the district; 


B) (U) a federal magistrate judge for a search of property or for a person either within or outside 
the district if the property or person is within the district when the warrant is sought but might 
move outside the district before the warrant is executed; 
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C) (U) a federal magistrate judge in any district in which activities related to the terrorism may 
have occurred, for a search of property or for a person within or outside the district, in an 
investigation of domestic terrorism or international terrorism (as defined in 18 U.S.C. § 2331); 
and 


D) (U) a magistrate with authority in the district to issue a warrant to install a tracking device. 
The warrant may authorize use of the device to track the movement of a person or property 
located within the district, outside, or both. 


(U) Physical searches related to a national security purpose may be authorized by the FISC. 
(50 U.S.C. §§ 1821-1829) 


18.7.1.3.4 (U) PROPERTY OR PERSONS THAT MAY BE SEIZED WITH A WARRANT 


(U) A warrant may be issued to search for and seize any: (i) property that constitutes evidence 
of the commission of a criminal offense; (ii) contraband, the fruits of crime, or things 
otherwise criminally possessed; or (iii) property designed or intended for use or that is or has 
been used as the means of committing a criminal offense. In addition to a conventional search 
conducted following issuance of a warrant, examples of search warrants include: 


18.7.1.3.4.1 (U) ANTICIPATORY WARRANTS 


(U) As the name suggests, an anticipatory warrant differs from other search warrants in 
that it is not supported by probable cause to believe that contraband exists at the premises 
to be searched at the time the warrant is issued. Instead, an anticipatory search warrant is 
validly issued where there is probable cause to believe that a crime has been or is being 
committed, and that evidence of such crime will be found at the described location at the 
time of the search, but only after certain specified events transpire. These conditions 
precedent to the execution of an anticipatory warrant, sometimes referred to as 
"triggering events,” are integral to its validity. Because probable cause for an anticipatory 
warrant is contingent on the occurrence of certain expected or "triggering" events, 
typically the future delivery, sale, or purchase of contraband, the judge making the 
probable cause determination must take into account the likelihood that the triggering 
event will occur on schedule and as predicted. Should these triggering events fail to 
materialize, the anticipatory warrant is void. 


18.7.1.3.4.2 (U) SNEAK AND PEEK SEARCH WARRANTS 


(U) A sneak and peek search warrant allows law enforcement agents to surreptitiously 
enter a location such as a building, an apartment, garage, storage shed, etc., for the 
urpose of looking for and documenting evidence of criminal activit 


18.7.1.3.4.3 (U) MAIL OPENINGS 


(U) Mail in United States postal channels may be searched only pursuant to court order, 
or presidential authorization. United States Postal Service regulations governing such 
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activities must be followed. A search of items that are being handled by individual 
couriers, or commercial courier companies, under circumstances in which there is a 
reasonable expectation of privacy, or have been sealed for deposit into postal channels, 
and that are discovered within properties or premises being searched, must be carried out 
according to unconsented FISA or FRCP Rule 41 physical search procedures. 


18.7.1.3.4.4 (U) COMPELLED DISCLOSURE OF THE CONTENTS OF STORED WIRE 
OR ELECTRONIC COMMUNICATIONS 


(U) Contents in “electronic storage” (e.g., unopened e-mail/voice mail) require a search 
warrant. See 18 U.S.C. § 2703(a). A distinction is made between the contents of 
communications that are in electronic storage (e.g., unopened e-mail) for less than 180 
days and those in "electronic storage" for longer than 180 days, or those that are no 
longer in "electronic storage” (¢.g., opened e-mail). In enacting the ECPA, Congress 
concluded that customers may not retain a "reasonable expectation of privacy” in 
information sent to network providers. However, the contents of an e-mail message that 
is unopened should nonetheless be protected by Fourth Amendment standards, similar to 
the contents of a regularly mailed letter. On the other hand, if the contents of an unopened 
message are kept beyond six months or stored on behalf of the customer after the e-mail 
has been received or opened, it should be treated the same as a business record in the 
hands of a third party, such as an accountant or attorney. In that case, the government 
may subpoena the records from the third party without running afoul of either the Fourth 
or Fifth Amendment. If a search warrant is used, it may be served on the provider without 
notice to the customer or subscriber. 


18.7.1.3.4.4.1 (U) SEARCH WARRANT 


(U/AFO8Q) Investigators can obtain the full contents of a network account with a search 
warrant. ECPA does not require the government to notify the customer or subscriber 
when it obtains information from a provider using a search warrant. Warrants issued 
under 18 U.S.C. § 2703 must either comply with FRCP Rule 41 or be an equivalent state 
warrant. Warrants issued pursuant to 18 U.S.C. § 2703 do not require personal service on 
the customer; the warrants are only be served on the electronic communication service or 
a remote computing service. FRCP Rule 41 requires a copy of the warrant be left with the 
provider, and a return and inventory be made. Federal courts have nationwide jurisdiction 
to issue these search warrants (see below). 


(U) With a search warrant issued based on probable cause pursuant to FRCP Rule 41 or 
an equivalent state warrant, the government may obtain: 


A) (U) The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for one hundred and eighty days or less, and 


B) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order with notice. 


(U) In other words, every record and all of the stored contents of an account—including 
opened and unopened e-mail/voice mail— can be obtained with a search warrant based 
on probable cause pursuant to FRCP Rule 41. Moreover, because the warrant is issued by 
a neutral magistrate based on a finding of probable cause, obtaining a search warrant 
effectively insulates the process from challenge under the Fourth Amendment. 
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18.7.1.3.4.4.2 (U) NATIONWIDE SCOPE 


(U) Search warrants under 18 U.S.C. § 2703(a) may be issued by a federal "court with 
jurisdiction over the offense under investigation,” and may be executed outside the 
district of the issuing court for material responsive to the warrant. State courts may also 
issue warrants under 18 U.S.C. § 2703(a), but the statute does not give these warrants 
effect outside the issuing court’s territorial jurisdiction. As with any other FRCP Rule 41 
warrant, investigators must draft an affidavit and a proposed warrant that complies with 
FRCP Rule 41. 


18.7.1.3.4.4.3 (U) SERVICE OF PROCESS 


(U) 18 U.S.C. § 2703(a) search warrants are obtained just like any other FRCP Rule 41 
search warrant but are typically served on the provider and compel the provider to find 
and produce the information described in the warrant. ECPA expressly states that the 
presence of an officer is not required for service or execution of a search warrant issued 
pursuant to 18 U.S.C. § 2703(a). 


18.7.1.3.4.4.4 (U) COURT ORDER WITH PRIOR NOTICE TO THE SUBSCRIBER OR CUSTOMER 


(U//FOCO+-Investigators can obtain everything in a network account except for 
unopened e-mail or voice-mail stored with a provider for 180 days or less using a 18 
U.S.C. § 2703(d) court order with prior notice to the subscriber unless they have obtained 
authority for delayed notice pursuant to 18 U.S.C. § 2705. ECPA distinguishes between 
the contents of communications that are in "electronic storage" (e.g., unopened e-mail) 
for less than 180 days, and those that have been in "electronic storage” for longer or that 
are no longer in "electronic storage" (e.g., opened e-mail). 


(U) FBI employees who obtain a court order under 18 U.S.C. § 2703(d), and either give 
prior notice to the subscriber or comply with the delayed notice provisions of 18 U.S.C. § 
2705(a), may obtain: 


A) (U) “The contents of a wire or electronic communication that has been in electronic storage in 
an electronic communications system for more than one hundred and eighty days.” 18 U.S.C. 
§ 2703(a). 


B) (U) "The contents of any wire or electronic communication" held by a provider of remote 
computing service "on behalf of . . . a subscriber or customer of such remote computing 
service,” 18 U.S.C. §§ 2703(b)(1)(B)Gi), 2703 (b)(2); and 


C) (U) Everything that can be obtained using a 18 U.S.C. § 2703(d) court order without notice. 
U 


U) 
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18.7.1.3.4.4.5 (U) LEGAL STANDARD 


(U) To order delayed notice, the court must find that "there is reason to believe that 
notification of the existence of the court order may... endanger the life or physical safety 
of an individual; [lead to] flight from prosecution; [lead to] destruction of or tampering 
with evidence; [lead to] intimidation of potential witnesses; or . . . otherwise seriously 
jeopardiz[e] an investigation or unduly delay[ ] a trial." 18 U.S.C. §§ 2705(a)(1)(A) and 
2705(a)(2). The applicant must satisfy this standard anew each time an extension of the 
delayed notice is sought. 


18.7.1.3.4.4.6 (U) NATIONWIDE SCOPE 


(U) Federal court orders under 18 U.S.C. § 2703(d) have effect outside the district of the 
issuing court. Orders issued pursuant to18 U.S.C. § 2703(d) may compel providers to 
disclose information even if the information is stored outside the district of the issuing 
court. See 18 U.S.C. § 2703(d) ("any court that is a court of competent jurisdiction” may 
issue a 18 U.S.C. § 2703[d] order); 18 U.S.C. § 2711(3) (court of competent jurisdiction 
includes any federal court having jurisdiction over the offense being investigated without 
geographic limitation). 

(U) 18 U.S.C. § 2703(d) orders may also be issued by state courts. See 18 U.S.C. §§ 
2711(3), 3127(2)(B). Such orders issued by state courts, however, do not have effect 
outside the jurisdiction of the issuing state. See 18 U.S.C. §§ 2711(3). 


18.7.1.3.4.4.7 (U) COURT ORDER WITHOUT PRIOR NOTICE TO THE SUBSCRIBER OR 
CUSTOMER 


(U) A court order under 18 U.S.C. § 2703(d) may compel disclosure of: 


A)(U) All "record(s) or other information pertaining to a subscriber to or customer of 
such service (not including the contents of communications [held by providers of 
electronic communications service and remote computing service])," and 


B) (U) Basic subscriber information that can be obtained using a subpoena without 
notice. 18 U.S.C. § 2703(c)(1). 


18.7.1.4 (U) APPROVAL REQUIREMENTS FOR INVESTIGATIVE METHOD 


A) (U//FOUO) Search warrants issued under authority of FRCP Rule 41: A warrant 


to search is issued by a federal magistrate (or a state court judge if a federal 
magistrate is not reasonably available). Coordination with the USAO or DOJ is 
required to obtain the warrant. 


B) (U/FO8O) FISA: In national security investigations, field office requests for FISA 
authorized physical searches must be submitted to FBIHQ using the FBI FISA 
Request Form. Field office requests for FISA approval are tracked throug] e] BIE 
This form should be completed by the case agent. 


C) (U/ÆSBO) Sensitive Investigative Matters (SIM): Notice to the appropriate FBIHQ 
operational Unit Chief and Section Chief is required if the matter under investigation 
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is a sensitive investigative matter. Notice to DOJ is also required, as described in 
DIOG Section 10. 


D) (U//FOUS) b7E 


(U) 28 C.F.R. § 50.10(b)(1)(ii) provides guidance on categories of individuals and entities not 
by, and therefore not entitled to the protections of the DOJ policy set out above. 


18.7.1.5 | (U) DURATION OF APPROVAL 
(U) The duration for the execution of a warrant is established by the court order or warrant. 
18.7.1.6 (U) SPECIFIC PROCEDURES 
18.7.1.6.1 (U) OBTAINING A WARRANT UNDER FRCP RULE 41 
18.7.1.6.1.1 (U) PROBABLE CAUSE 


(U/FO869) After receiving an affidavit or other information, a magistrate judge or a 
judge of a state court of record must issue the warrant if there is probable cause to search 
for and seize a person or property under FRCP Rule 41(c). Probable cause exists where 
“the facts and circumstances within the FBI employee’s knowledge, and of which they 
had reasonably trustworthy information are sufficient in themselves to warrant a person 
of reasonable caution in the belief that...” a crime has been or is being committed, and 
that sizable property can be found at the place or on the person to be searched. Probable 
cause is a reasonable belief grounded on facts. In judging whether a reasonable belief 
exists, the test is whether such a belief would be engendered in a prudent person with the 
officer’s training and experience. To establish probable cause, the affiant must 
demonstrate a basis for knowledge and belief that the facts are true and that there is 
probable cause to believe the items listed in the affidavit will be found at the place to be 
searched. 


18.7.1.6.1.2 (U) REQUESTING A WARRANT IN THE PRESENCE OF A JUDGE 


A) (U) Warrant on an Affidavit: When a federal law enforcement officer or an attorney for the 
government presents an affidavit in support of a warrant, the judge may require the affiant to 
appear personally and may examine under oath the affiant and any witness the affiant 
produces. 


B) (U) Warrant on Sworn Testimony: The judge may wholly or partially dispense with a written 
affidavit and base a warrant on sworn testimony if doing so is reasonable under the 
circumstances. 


C) (U) Recording Testimony: Testimony taken in support of a warrant must be recorded by a 
court reporter or by a suitable recording device, and the judge must file the transcript or 
recording with the clerk, along with any affidavit. 
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18.7.1.6.1.3 (U) REQUESTING A WARRANT BY TELEPHONIC OR OTHER MEANS 


A) (U) In General: A magistrate judge may issue a warrant based on information 
communicated by telephone or other appropriate means, including facsimile transmission. 


B) (U) Recording Testimony: Upon learning that an applicant is requesting a warrant, a 
magistrate judge must: (i) place under oath the applicant and any person on whose testimony 
the application is based; and (ii) make a verbatim record of the conversation with a suitable 
recording device, if available, or by a court reporter, or in writing. 


C) (U) Certifying Testimony: The magistrate judge must have any recording or court reporter's 
notes transcribed, certify the transcription's accuracy, and file a copy of the record and the 
transcription with the clerk. Any written verbatim record must be signed by the magistrate 
judge and filed with the clerk. 


D) (U) Suppression Limited: Absent a finding of bad faith, evidence obtained from a warrant 
issued under FRCP Rule 41(d)(3)(A) is not subject to suppression on the ground that issuing 
the warrant in that manner was unreasonable under the circumstances. 


18.7.1.6.1.4 (U) ISSUING THE WARRANT 


(U) In general, the magistrate judge or a judge of a state court of record must issue the 
warrant to an officer authorized to execute it. The warrant must identify the person or 
property to be searched, identify any person or property to be seized, and designate the 
magistrate judge to whom it must be returned. The warrant must command the officer to: 
(i) execute the warrant within a specified time no longer than 14 days; (ii) execute the 
warrant during the daytime, unless the judge for good cause expressly authorizes 
execution at another time; and (iii) return the warrant to the magistrate judge designated 
in the warrant. 


18.7.1.6.1.5 (U) WARRANT BY TELEPHONIC OR OTHER MEANS 


(U) If a magistrate judge decides to proceed under FRCP Rule 41(d)(3)(A), the following 
additional procedures apply: 


A) (U) Preparing a Proposed Duplicate Original Warrant: The applicant must prepare a 
“proposed duplicate original warrant" and must read or otherwise transmit the contents of that 


document verbatim to the magistrate judge. 


B) (U) Preparing an Original Warrant: The magistrate judge must enter the contents of the 
proposed duplicate original warrant into an original warrant. 


C) (U) Modifications: The magistrate judge may direct the applicant to modify the proposed 
duplicate original warrant. In that case, the judge must also modify the original warrant. 


D) (U) Signing the Original Warrant and the Duplicate Original Warrant: Upon determining to 
issue the warrant, the magistrate judge must immediately sign the original warrant, enter on its 


face the exact time it is issued, and direct the applicant to sign the judge's name on the 
duplicate original warrant. 


18.7.1.6.1.6 (U) WRITTEN OPERATION ORDERS FOR SEARCH OPERATIONS 


(U) The ADIC/SAC is responsible to ensure that careful and thorough planning is 
conducted for the successful execution of a high risk search operation involving a 
potentially dangerous situation or subject. The plan must be adapted to each situation and 
must include relevant details to enhance the safety and effectiveness of the agents and 
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officers involved in the search operation. The planning and execution of arrests, raids, 
and searches should be assigned to experienced Agents. All plans must be approved by 
ASACSs or their designees. 


(U) Prior to conducting a search operation deemed a high risk, the agent must prepare a 
written operation order (OPORDER) to include the five critical categories: Situation, 
Mission, Execution, Administration and Equipment, and Control and Communication 
(SMEAC), and must utilize the Law Eafercement Operations Order (OPORDER), ED- 
&&8. In situations where an FBI SWAT Team(s) or the Critical Incident Response 
Group’s (CIRG), Tactical Section is involved, the Operations Order Template must be 
used in lieu of the FD-888. See thel 

an for more on the use of the SWAT 
Teams and CIRG, Tactical Section in high risk operations. 


(U) The written OPORDER must be presented in an oral briefing to all personnel 
involved in the execution of the search warrant prior to the operation. During the briefing, 
the briefing agent should stress to the participants of the operation that the search has the 
potential to become dangerous. At the discretion of the field office approving official, the 
CDC/ADC may review the OPORDER (#-888) and/or participate in providing the FBI 


deadly force briefing to the search operation participants. 


(U) Exigent circumstances (i.e., emergency, pressing necessity requiring immediate 
action) may necessitate an oral briefing in lieu of the written OPORDER. The ASAC or 
designee must approve the use of an oral briefing in lieu of a written and approved 
OPORDER in exigent circumstances. An oral briefing must follow the requirements of a 
written OPORDER to address the SMEAC categories identified above. Documentation of 
the oral briefing must occur as soon as possible following the operation by preparing and 
filing the £1>-888 or the Operations Order Template, whichever is appropriate for the 
situation. 
(U) The agent may consider utilizing, and/or alerting local authorities to the planned 
search, if appropriate under the circumstances. Although the time of notification is left to 
the discretion of the agent, he/she must consider the jurisdiction of local law 
enforcement, its responsibility to its community and its need to be aware of law 
enforcement actions in its jurisdiction. 


18.7.1.6.1.7 (U) EXECUTING AND RETURNING THE WARRANT 


A) (U) Noting the Time: The officer executing the warrant must enter on its face the exact date 
and time it is executed. 


B) (U) Inventory: An officer present during the execution of the warrant must prepare and verify 
an inventory of any property seized. The officer must do so in the presence of another officer 
and the person from whom, or from whose premises, the property was taken. If either one is 
not present, the officer must prepare and verify the inventory in the presence of at least one 
other credible person. 

C) (U) Receipt: The officer executing the warrant must: (i) give a copy of the warrant and a 
receipt for the property taken to the person from whom, or from whose premises, the property 
was taken; or (ii) leave a copy of the warrant and receipt at the place where the officer took the 
property. 
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D) (U) Return: The officer executing the warrant must promptly return it — together with a copy 
of the inventory — to the magistrate judge designated on the warrant. The judge must, on 
request, give a copy of the inventory to the person from whom, or from whose premises, the 
property was taken and to the applicant for the warrant. 


18.7.1.6.1.8 (U) FORWARDING PAPERS TO THE CLERK 


(U) The magistrate judge to whom the warrant is returned must attach to the warrant a 
copy of the return, the inventory, and all other related papers and must deliver them to the 
clerk in the district where the property was seized. (FRCP Rule 41) 


18.7.1.6.1.9 (U) WARRANT FOR A TRACKING DEVICE 


A) (U) Noting the Time: The officer executing a tracking device warrant must enter on it the 
exact date and time the device was installed and the period during which it was used. 


B) (U) Return: Within 10 calendar days after the use of the tracking device has ended, the officer 
executing the warrant must return it to the judge designated in the warrant. 


C) (U) Service: Within 10 calendar days after use of the tracking device has ended, the officer 
executing the warrant must serve a copy of the warrant on the person who was tracked. 
Service may be accomplished by delivering a copy to the person who, or whose property was 
tracked; or by leaving a copy at the person’s residence or usual place of abode with an 
individual of suitable age and discretion who resides at that location and by mailing a copy to 
the person’s last known address. Upon request of the government, the judge may delay notice 
as provided in FRCP Rule 41(f)(3). 


18.7.1.6.1.10 (U) DELAYED NOTICE 


(U) Upon the government’s request, a magistrate judge—or if authorized by FRCP Rule 
41(b), a judge of a state court of record—may delay any notice required by FRCP Rule 
41 if the delay is authorized by statute. 


18.7.1.6.2 (U) OBTAINING A FISA WARRANT 


(U) Applications for court-authorized physical search pursuant to FISA must be made by a 
federal officer in writing upon oath or affirmation and with the specific approval of the 
Attorney General. (See 50 U.S.C. § 1823). 


18.7.1.6.2.1 (U) CERTIFICATE BY THE DIRECTOR OF THE FBI 


(U) Each FISA application must be accompanied by a Certification by the Director of the 
FBI or one of nine other individuals authorized by Congress or the President to provide 
such certifications that: the information being sought is foreign intelligence information; 
that a significant purpose of the search is to obtain foreign intelligence information; that 
such information cannot reasonably be obtained by normal investigative techniques; that 
the information sought is "foreign intelligence information" as defined by FISA. The 
certification must include a statement explaining the certifier's basis for the certification. 


(U) 50 U.S.C. § 1823 specifies the Assistant to the President for National Security 
Affairs; E.O. 12139 as amended by E.O. 13383 specifies the Director of the FBI, Deputy 
Director of the FBI, the Director of National Intelligence, the Principal Deputy Director 
of National Intelligence, the Director of the Central Intelligence Agency, the Secretary of 
State, the Deputy Secretary of State, the Secretary of Defense, and the Deputy Secretary 
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of Defense as appropriate officials to make certifications required by FISA. The FBI 
Director has represented to Congress that the FBI deputy Director will only certify 
FISA’s when the FBI Director is not available to do so. 


18.7.1.6.2.2 (U) LENGTH OF PERIOD OF AUTHORIZATION FOR FISC ORDERS 


(U) Generally, a FISC Order approving an unconsented physical search will specify the 
period of time during which physical searches are approved and provide that the 
government will be permitted the period of time necessary to achieve the purpose, or for 
90 days, whichever is less, except that authority may be: 


A) (U) For no more than one year for "Foreign Power" targets (establishments); or 


B) (U) For no more than 120 days for a non-USPER agent of a foreign power, with renewals for 
up to one. 


18.7.1.6.2.3 (U) EXTENSION OF PHYSICAL SEARCH AUTHORITY 


(U//F666) An extension of physical search authority may be granted on the same basis 
as the original order upon a separate application for an extension and upon new findings 
made in the same manner as the original order. 


18.7.1.6.2.4 (U) EMERGENCY FISA AUTHORITY 


A) (U) The Attorney General may authorize an emergency physical search under FISA when he 
reasonably makes a determination that an emergency situation exists that precludes advance 
FISA court review and approval, and there exists a factual predication for the issuance of a 
FISA Court Order. In such instances, a FISC judge must be informed by the Attorney General 
or his designee at the time of the authorization and an application according to FISA 
requirements is submitted to the judge as soon as is practicable but not more than seven (7) 
days after the emergency authority has been approved by the Attorney General. 


B) (U) If a court order is denied after an emergency authorization has been initiated, no 
information gathered as a result of the search may be used in any manner except if with the 
approval of the Attorney General, the information indicates a threat of death or serious bodily 
harm to any person. 


C) (U//FEBO} For an emergency FISA for physical search, l b7E 


18.7.1.6.2.5 (U) SPECIAL CIRCUMSTANCES 


(U) The President through the Attorney General may also authorize a physical search 
under FISA without a court order for periods of up to one year, if the Attorney General 
certifies that the search will be solely directed at premises, information, material, or 
property that is used exclusively by or under the open and exclusive control of a foreign 
power; there is no substantial likelihood that the physical search will involve the 
premises, information, material, or property of a United States person (USPER); and 
there are minimization procedures that have been reported to the court and Congress. The 
FBI's involvement in such approvals is usually in furtherance of activities pursued 
according to E.O. 12333. Copies of such certifications are to be transmitted to the FISA 
Court. See 50 U.S.C. § 1822[a]. 
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(U) Information concerning USPERs acquired through unconsented physical searches 
may only be used according to minimization procedures. See: 50 U.S.C. §§ 1824(d)(4) 
and 1825(a). 


18.7.1.6.2.6 (U) REQUIRED NOTICE 


(U) If an authorized search involves the premises of an USPER, and the Attorney General 
determines that there is no national security interest in continuing the secrecy of the 
search, the Attorney General must provide notice to the USPER that the premises was 
searched and the identification of any property seized, altered, or reproduced during the 
search, 


18.7.1.6.2.7 (UTFOCO}FISA VERIFICATION OF ACCURACY PROCEDURES 
U/EQRO BIE 


UA 


b7E 


3) _(U//FƏ89)| 


B) (U//FOUS! 
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18.7.1.6.2.8 (U) USE OF FISA DERIVED INFORMATION IN OTHER PROCEEDINGS 


(UAFORS) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 
authority of the United States. . . .” See DIOG Appendix E for the AG Memo, Revised 
Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictl 
followed. Though not contained in the AG Memo, FBI policy requires that 


bIE 


(U//FOGO) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1801(k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 


18.7.1.6.2.9 (U/FO8O Pe 


(U/AFE88) Each investigative file for which an application is or has been prepared for 
submission to the FISC will include a sub-file to be labele 
eee mT SUP-TIS To SOMA Copies 


of all applications to and orders issued by the FISC for the conduct of physical searches 
in the investigation. The following data must be included in this} 


e 


and 
powo ~My 
| 


18.7.1.6.2.10 (U/FFOCOYFISA RENEWALS 
(UFFERO) b7E 


(Uli 
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(U/FERO DIE 


18.7.1.6.2.10.1 (U) APPEALING THE DECISION OF THE REVIEW BOARD 


18.7.1.6.2.11 (U) COMPLIANCE AND MONITORING FOR FISA 


18.7.1.6.2.12 (U) FISA OVERCOLLECTION 


contact NSLB for further guidance regarding the handling of any 
FISA overcollection. 


18-183 Version Dated: 
UNCLASSIFIED - FOR-OFFHEMEHSEONF* March 3, 2016 


UNCLASSIFIED -FOR-OFFICTAL CSE ONE 
Domestic Investigations and Operations Guide 


This Page is Intentionally Blank. 


UNCLASSIFIED - BOR-OFFICIAL-USE-ONLY 


UNCLASSIFIED - FOR-OFFICTAL CSE ONE Y— 
Domestic Investigations and Operations Guide §18 


18.7.2 (U) INVESTIGATIVE METHOD: ELECTRONIC SURVEILLANCE — TITLE III 
18.7.2.1 (U) SUMMARY 


(U//FOCS) Electronic Surveillance (ELSUR) under Title III is a valuable investigative 
method. It is, also, a very intrusive means of acquiring information relevant to the effective 
execution of the FBI’s law enforcement. To ensure that due consideration is given to the 
competing interests between law enforcement and the effect on privacy and civil liberties, this 
section contains various administrative and management controls beyond those imposed by 
statute and DOJ guidelines. Unless otherwise noted, it is the responsibility of the case agent 
and his/her supervisor to ensure compliance with these isi | 

itle I ELSUR 
requires: (i) administrative or judicial authorization prior to its use; (ii) contact with the field 
office ELSUR Technician to coordinate all necessary recordkeeping; and (iii) consultation 
with the Technical Advisor (TA) or a designated TTA to determine feasibility, applicability, 
and use of the appropriate equipment. 


18.7.2.2 (U) LEGAL AUTHORITY 


(U) Title III ELSUR is authorized by chapter 119, 18 U.S.C. §§ 2510-2522 (Title III of the 
Omnibus and Safe Streets Act of 1968). 


18.7.2.3 (U) DEFINITION OF INVESTIGATIVE METHOD 


(U) Title IN ELSUR is the non-consensual electronic collection of information (usually 
communications) under circumstances in which the parties have a reasonable expectation of 
privacy and court orders or warrants are required. 


18.7.2.4 (U) TITLE IHI GENERALLY 


(U) With the prior approval of the Attorney General, or Attorney General’s designee, the 
United States Attorney, by and through an AUSA, or the Strike Force Attorney, may apply to 
a federal judge for a court order authorizing the interception of wire, oral, or electronic 
communications relating to one or more of the offenses listed in Title HI (18 U.S.C. § 2516). 
Judicial oversight continues throughout the operational phase of the electronic surveillance 
including the installation, monitoring, and handling of recording media. 


(U) For purposes of obtaining review and approval for use of the method, Title III 
applications are considered to be either “sensitive” or “non-sensitive.” The requirements for 
each are set forth below. 
18.7.2.5 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR NON- 
SENSITIVE TITLE IIIs 


(U//FE86) An SAC is the authorizing official to approve all requests for “non-sensitive” 
Title III orders, including original, extension, and renewal applications. SAC approval of all 
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extensions and renewals is required to ensure that field office managers will allocate the 
resources necessary to use this method. Any delegation of SAC approval authority to an 
ASAC under this section must be in writing (See DIOG Section 3.4.3). 


(U//F@GOF Prior to SAC approval referred to above, CDC or OGC review is required for the 
initial “non-sensitive” Title III order. Extensions and renewals sought within 30 days after the 
expiration of the original Title III order in non-sensitive Title IIIs do not require CDC review, 
unless requested by the SAC or designee. The CDC must review renewals sought more than 
30 days after the expiration of the original Title III order. 


(U/TFOGS) There may be situations or unusual circumstances requiring the FBI to adopt an 
already existing Title II from another federal law enforcement agency. Such adoptions may 
only be done on a case-by-case basis, in exceptional circumstances, and subject to the 
requirements set forth herein relating to CDC review and SAC approval. Should the Title III 
proposed for adoption involve sensitive circumstances, it must also be handled in accordance 
with the approval and review requirements set forth below. 


18.7.2.6 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR SENSITIVE 
TITLE IIs 


(U//FE88) All Title III applications involving one of the seven “sensitive circumstances,” 
listed below, including all extensions and renewals, must be reviewed by OGC and approved 
by FBIHQ. The SAC, with the recommendation of the CDC, must determine whether the 
request involves sensitive circumstances. The term “sensitive circumstances” as used in this 
section relating to electronic surveillance under Title III is different from the term “sensitive 
investigative matters,” as used in conjunction with approval requirements for opening 
Assessments and Predicated Investigations, and is different from the term “sensitive 
monitoring circumstances” as used in conjunction with the approval requirements for 
consensual monitoring. 


(U/FORO) The field office must include a copy of the completed CDC checklist (FD-926) 
when forwarding the initial sensitive Title III applications to OGC and FBIHQ for review. 
After the initial submission, the CDC checklist must be completed by the appropriate OGC 
unit for all subsequent extensions or renewals of sensitive Title IIIs. 


(U/FƏ69) Although ultimate approval for sensitive Title IIIs is at the FBIHQ level, the SAC 
or ASAC must continue to review and approve the use of the method for all sensitive Title I 
applications as it relates to the allocation of resources within their field office. 


(U//FƏ¥89) The following five sensitive circumstances require the approval of a Deputy 
Assistant Director (DAD) or a higher level official from the Criminal Investigative Division 
(CID), Cyber Division, Counterterrorism Division (CTD), Weapons of Mass Destruction 
Directorate (WMDD), or Counterintelligence Division (CD), as appropriate, and such 
approvals must be documented in an EC: 


A) (U/POROF Significant privilege issues or First Amendment concerns (e.g., attorney-client 
privilege or other privileged conversations or interception of news media representatives); 


B) (U/AFOCO) Significant privacy concerns are anticipated (e.g., placing a microphone in a 
bedroom or bathroom); 
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C) (U/BO@H6) Application is based on “relaxed specificity” (i.e., “roving” interception) under 18 
U.S.C. § 2518(11)(a) and (b); 


D) (U//FOCS) Application concerns a Domestic Terrorism (DT), International Terrorism, or 
Espionage investigation; or 


E) (U/2QUQ) Any situation deemed appropriate by the AD of CID or OGC. 


(U//FƏ86) The following two sensitive circumstances require the approval of the Director, 
the Acting Director, Deputy Director, or the Executive Assistant Director (EAD) for the 
Criminal Cyber Response and Services Branch or National Security Branch, or the respective 
Assistant Director for Criminal Investigative Division (CID), Cyber Division, 
Counterterrorism Division (CTD), Weapons of Mass Destruction Directorate (WMDD), or 
Counterintelligence Division (CD), and such approvals must be documented in an EC: 


A) (U/PORO) "Emergency" Title III interceptions (i.e., interceptions conducted prior to judicial 
approval under 18 U.S.C. § 2518(7)); or 

B) (U//FOBO) It is anticipated that conversations of members of Congress, federal judges, high- 
level federal officials, high-level state executives, or members of a state judiciary or 
legislature will be intercepted. 


(U//FOUS) “Sensitive circumstances” may develop at any point in time during the course of a 
Title III. For example, while an initial application for interceptions might not be considered 
sensitive, conversations intercepted thereafter of a high-level state executive would render any 
subsequent spinoffs, extensions, or renewals “sensitive” Title III requests. 


18.7.2.7 (U) PROCEDURES FOR EMERGENCY TITLE III INTERCEPTIONS 


(U/FOUGT 18 U.S.C. § 2518(7) provides that any investigative or law enforcement officer, 
specially designated by the Attorney General, Deputy Attorney General, or the Associate 
Attorney General, who reasonably determines that an emergency situation exists that requires 
communications to be intercepted before an order authorizing such interception can, with due 
diligence, be obtained, and there are grounds upon which an order could be entered 
authorizing interception, may intercept such communications. 


(U//FOUGF Section 2518(7) postpones, rather than eliminates the need for judicial 
authorization. If the Attorney General, Deputy Attorney General, or the Associate Attorney 
General authorizes an appropriate FBI official to approve an emergency Title III interception, 
an after-the-fact application for an order approving the interception must be made in 
accordance with Title III to the appropriate Court, and an order obtained, within 48 hours after 
the interception has occurred or begins to occur. 


UFOO BIE 
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(U) 18 U.S.C. § 2518(7) defines an emergency situation as one involving: 
A) (U) immediate danger of death or serious physical injury to any person, 
B) (U) conspiratorial activities threatening the national security interest, or 
C) (U) conspiratorial activities characteristic of organized crime. 


(U//FEGS) In all but the most unusual circumstances, the only situations likely to constitute 
an emergency by the Department of Justice (DOJ) are those involving an imminent threat to 
life, e.g., a kidnapping, hostage taking, or imminent terrorist activity. 


18.7.2.7.1 (U) OBTAINING EMERGENCY AUTHORIZATION 


A) (U/FORO 


B) (U// 


C) (UFOO) 
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18.7.2.7.2 (U) POST-EMERGENCY AUTHORIZATION 


(U/#OU9) Once the AG or his designee has authorized the Director, or his designee to make 
the determination whether to proceed with the emergency Title III, the government has 48 
hours (including weekends and holidays) from the time the AG granted authorization to apply 
for a court order approving the interception. The field office, in coordination with the AUSA, 
must immediately begin preparing an affidavit, application and proposed order for court 
authorization. 


(U/FOO) The affidavit in support of the after-the-fact application to the court for an order 
approving the emergency interception must contain only those facts known to the AG or his 


designee at the time the emergency interception was approved. The application must be 
accompanied by th form, be 


which must reflect the date and time of the emergency authorization. 


(U/FFOGS) The government may also request, at the time it files for court-authorization for 
the emergency, court-authorization to continue the interception beyond the initial 48 hour 
period. If continued authorization is sought at the same time, one affidavit may be submitted 
in support of both requests. However, the affidavit must clearly indicate what information was 
communicated to the AG or his designee at the time the emergency interception was approved 
and what information was developed thereafter. Two separate applications and proposed 
orders should be submitted to the court in this situation — one set for the emergency and one 
set for the extension. If continued interceptions are not being sought, no further authorization 
is needed from OEO. The AUSA should, however, still submit the application, affidavit, and 
order to OEO for review. If continued interceptions are sought, that application, affidavit, and 
order must be reviewed by OEO and approved by DOJ like any other Title III request. In 
either situation, the affidavit must also be submitted through the operational unit for OGC 
review, when time allows. 


Oae o sss Ffeese 


(U//FOUS) Pursuant to 18 U.S.C. § 2518(7), in the absence of a court order, interception 
shall immediately terminate when the communication sought is obtained or when the 
application for the order is denied, whichever is earlier. In the event an application for 
approval is denied, or in any other case where the interception is terminated without an order 
having been issued, the contents of any wire, oral, or electronic communication intercepted 
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shall be treated as having been obtained in violation of Title III, and an inventory shall be 
served on the person named in the application. 


a 
(eT 


18.7.2.8 (U) PRE-TITLE II ELECTRONIC SURVEILLANCE (ELSUR) SEARCH POLICY 


(U//FEBO) 18 U.S.C § 2518(1)(e) requires that each application for an order to intercept 
wire, oral, or electronic communications (hereinafter “Title IIT”) contain a statement 
describing all previous applications for Title HI surveillance of the same persons, facilities, or 
places named in the current application. 


(U) For specific details on how to conduct and document such ELSUR searches, see DIOG 
Appendix H. 


18.7.2.9 (U) DURATION OF APPROVAL FOR TITLE III 


(U) Court orders issued pursuant to Title II are for a period not to exceed 30 days. An 
“extension” order may be sought to continue monitoring beyond the initial 30-day period 
without a lapse in time. When a break in coverage has occurred, a “renewal” order may be 
sought to continue monitoring the same interceptees and facilities identified in the original 
order. The affidavit and application in support of an extension or renewal must comply with 
all of the Title III requirements, including approval of the Attorney General or designee. 


18.7.2.10 (U) SPECIFIC PROCEDURES FOR TITLE III AFFIDAVITS 


(U//FOCS) The requirements in 18 U.S.C. § 2518 must be followed in the preparation of a 
Title III affidavit. The employee drafting the Title II affidavit and approving officials must 
consider the following requirements: 


A) (U/P@88) The identity and qualifications of the affiant must be articulated; 
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B) (UHFOEO) For the interception of wire or oral communications, the affidavit must establish 
probable cause to believe a violation of at least one of the offenses enumerated in 18 U.S.C. § 
2516(1) has been, is being, or will be committed. For the interception of electronic 
communications, the affidavit must establish probable cause to believe that some federal 
felony has been, is being, or will be committed; 


C) (U/FS89) The affidavit must set forth the identities of those persons, if known, for whom 
there is probable cause to believe they are committing the alleged offenses, even if it is not 
believed they will be intercepted over the target facility. This group of individuals is often 
referred to as the “Subjects.” “Interceptees” may be listed separately; “interceptee” are those 
Subjects who are expected to be intercepted; 


D) (U//FOUO) Probable cause must be current and relevant to the use of the particular facilities 
for which interception is sought; 


E) (U//FOUD) The necessity for the Title III must be articulated. There must be a factual basis 
for concluding that alternative investigative procedures have been tried and failed or a 
demonstration why these procedures appear to be unlikely to succeed or would be too 
dangerous if tried ("boilerplate" statements in this respect are unacceptable); 


F) (U//FO®O) Interceptions must be minimized, as statutorily required; 


G) (U//E@RO) The facility or premises to be intercepted must be described fully, including a 
diagram, if possible, if microphone installation is contemplated (surreptitious entries may not 
be conducted for the purpose of preparing a diagram); and 


H) (U//FE8O) A statement describing all previous applications for Title III surveillance of the 
same persons (both subjects and interceptees), facilities or places named in the current 
affidayi i i ent, a "search," e.g., an automated indices search of the 
FBI's system and the systems of other appropriate agencies, 
must be conducted prior to submitting the Title III affidavit to the DOJ OEO (non-sensitive 
circumstances) or to the responsible FBIHQ operational unit (sensitive circumstances). The 
squad SSA is responsible for verifying that pre-Title I ELSUR checks have been completed 
before the affidavit is sent to the court. The ELSUR Operations Technician (EOT) and the 
ELSUR supervisor are responsible for confirming that ELSUR searches were properly 
conducted as set forth in the final application submitted to the court. 


(U//FE89) Note: When drafting the Title III Affidavit, the agent must determine whether the 
proposed Title III intercept involves any of the DOJ-designated seven "sensitive 
circumstances" listed in DIOG Section 18.7.2.6. If the proposed Title II will involve one or 
more of the seven "sensitive circumstances," the agent must consult with the assigned AUSA 
to determine how the "sensitive circumstance(s)" will be addressed and how/when the federal 
judge will be notified. 


(U//FOCO) Note: It is also recommended that the application include how the FBI will 
address any sensitive circumstances as listed in DIOG Section 18.7.2.6, if they exist. 


(U/AFGO) At least 10 calendar days prior to submitting the original Title II request to DOJ 
OEO, the field office must forward an electronic communication to FBIHQ setting forth by 
separate subheading: a synopsis of the investigation; the priority of the investigation within 
the office; the anticipated manpower and/or linguistic requirements and outside support, if 
any, that will be needed; a synopsis of the probable cause supporting the Title III application; 
the prosecutive opinion of the USAO; and description of the interceptees. If a field office is 
unable to submit the EC 10 calendar days prior to submitting the request to DOJ OEO, the 
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field office must advise the operational unit immediately and note the circumstances that 
prevent timely notification. 


(U/FOUD) Case agents a 
| 


18.7.2.11  (U) DISPUTE RESOLUTION FOR TITLE III APPLICATIONS 


(U//FƏ89) When there are legal questions/concerns that cannot be resolved through 
discussions with reviewing officials at DOJ, the responsible FBIHQ operational division 
supervisors or executives must forward the application to OGC for its review, advice, and 


recommendation. 


18.7.2.12 (U) REPORTING AND NOTICE REQUIREMENTS — TITLE III 


(U; b7E 


omo) we 


U/FOCO 
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(U/FOCO b7E 


(U//FORO) b7E 


U//FOYO| 


18.7.2.12.1 (U//FOGO) NOTICE REQUIREMENTS FOR SENSITIVE INVESTIGATIVE 
MATTERS (SIM) THAT INVOLVE TITLE II INTERCEPTIONS 


(U//FOUS) The anticipated interception of conversations related to a “Sensitive Investigative 
Matter” (SIM) as defined in DIOG Section 10 requires notice to the appropriate FBIHQ Unit 
Chief and Section Chief, and DOJ Criminal Division. Note: A sensitive investigative matter 
(SIM) is not the same as a sensitive circumstance described in DIOG Section 18.7.2.6. 


18.7.2.13  (U) JOINT TITLE IT] OPERATIONS WITH OTHER LAW ENFORCEMENT 
AGENCIES 


18.7.2.13.1 (U) FEDERAL LAW ENFORCEMENT AGENCIES 


(U//FOBS) In joint FBI operations with other federal law enforcement agencies wherein 
electronic surveillance is conducted through a Title II] installation, the federal agency 
administering the electronic surveillance will assume overall responsibility for ELSUR 
indexing and recordkeeping. The fact that the investigation is a joint operation with another 
federal law enforcement agency must be stated in the affidavit and application for the court 
order. The joint federal agency must provide the FBI case agent with a copy of the court order 
and application. 


(U//EOUO bIE 


18.7.2.13.2 (U) STATE AND LOCAL LAW ENFORCEMENT AGENCIES 


(U/ÆƏ¥89) In joint FBI operations involving state and local law enforcement agencies 
wherein electronic surveillance is conducted through a federal Title III installation, any state 
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officer being used as an affiant must be federally deputized. The FBI will be the administering 
agency responsible for the indexing and recordkeeping. 


(U/ÆƏ89) In joint FBI operations involving state and local law enforcement agencies 
wherein electronic surveillance is conducted pursuant to the authorization of a state court (i.e. 
a wiretap authorized by a state court, as opposed to a federal court), 


bIE 


18.7.2.14 (U) EVIDENCE HANDLING 


(U//FE@88) All ELSUR downloading, processing, and handling of original, derivative, and 

copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated employee (e.g. an agent who has successfully completed 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded iniof 7] 
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18.7.3. (U) INVESTIGATIVE METHOD: ELECTRONIC SURVEILLANCE — FISA AND 
FISA TITLE VII (ACQUISITION OF FOREIGN INTELLIGENCE 
INFORMATION) 


18.7.3.1 (U) SUMMARY 


(U//FE8QLELSUR conducted pursuant to the Foreign Intelligence Surveillance Act (FISA) 
is a valuable investigative method. It is, also, a very intrusive means of acquiring information 
relevant to the effective execution of the FBI’s national security and intelligence missions. To 
ensure that due consideration is given to the competing interests between national security and 
the effect on privacy and civil liberties, this section contains various administrative and 
management controls beyond those imposed by statute and DOJ guidelines. Unless otherwise 
noted, it is the responsibility of the case agent and his/her supervisor to ensure compliance 
with these instructions. FISA ELSUR is only authorized as an investigative method in the 
conduct of Full Investigations. FISA ELSUR requires administrative or judicial authorization 
prior to its use. 


(U//FOCS) Coordination: b7E 


b7E 


(U//PES) Application: 


(U) This section is divided below into FISA (18.7.3.2) and FISA Title VII (18.7.3.3). 
18.7.3.2 (U) FOREIGN INTELLIGENCE SURVEILLANCE ACT (FISA) 
18.7.3.2.1 (U) LEGAL AUTHORITY 
(U) 50 U.S.C. §§ 1801-1811 (FISA) and E.O. 12333 § 2.5. 
(U) FISA Amendments Act of 2008 (P.L.No. 110-261). 
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18.7.3.2.2 (U) DEFINITION OF INVESTIGATIVE METHOD 


(U) FISA is the non-consensual electronic collection of information (usually communications) 
under circumstances in which the parties have a reasonable expectation of privacy and court 
orders or warrants are required. 


18.7.3.2.3 (U) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR FISA 
18.7.3.2.3.1 (U) FISA REQUEST FORM 


(U/ÆƏUO) FBIHQ and field office requests for FISC ELSUR orders must use the FISA 
Request Form. Field office requests for FISA orders are submitted and tracked through 
The FISA request forms, in a question and answer format, have been designed bIE 
to ensure that all information needed for the preparation of a FISC application is provided 
to FBIHQ and to the DOJ. 


umos |] S 


for additional guidance. 
18.7.3.2.3.2 (U) CERTIFICATE BY THE DIRECTOR OF THE FBI 


(U) Each FISA application must be accompanied by a Certification by the Director of the 
FBI or one of nine other individuals authorized by Congress or the President to provide 
such certifications that: the information being sought is foreign intelligence information; 
that a significant purpose of the electronic surveillance is to obtain foreign intelligence 
information; that such information cannot reasonably be obtained by normal investigative 
techniques; that the information sought is "foreign intelligence information” as defined 
by FISA. The certification must include a statement explaining the certifier's basis for the 
certification. 


(U) Title 50 of the United States Code Section 1804 specifies the Assistant to the 
President for National Security Affairs; E.O. 12139 as amended by E.O. 13383 specifies 
the Director of the FBI, Deputy Director of the FBI, the Director of National Intelligence, 
the Principal Deputy Director of National Intelligence, the Director of the Central 
Intelligence Agency, the Secretary of State, the Deputy Secretary of State, the Secretary 
of Defense, and the Deputy Secretary of Defense as appropriate officials to make 
certifications required by FISA. The FBI Director has represented to Congress that the 
FBI Deputy Director will only certify FISA’s when the FBI Director is not available to 
do so. 


18.7.3.2.3.3 (U) EMERGENCY FISA AUTHORITY (50 U.S.C. § 1805[F]) 


(U) The Attorney General, on request from the Director of the FBI or his/her designee, 
may authorize an emergency FISA for electronic surveillance when it is reasonably 
determined that an emergency situation exists that precludes advance FISC review and 
approval and that a factual predication for the issuance of a FISA Order exists. A FISC 
judge must be informed by DOJ at the time of the emergency authorization and an 
application must be submitted to that judge as soon as is practicable but not more than 
seven (7) days after the emergency authority has been approved by the Attorney General. 
If a court order is denied after an emergency surveillance has been opened, no 
information gathered as a result of the surveillance may be used as evidence or disclosed 
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in any trial or other proceeding, and no information concerning any USPER acquired 
from such surveillance may be used or disclosed in any manner, except with the approval 
of the Attorney General if the information indicates a threat of death or serious bodily 
harm to any person. 


U//FECO Bie 


18.7.3.2.4 (U) DURATION OF APPROVAL FOR FISA 


18.7.3.2.5 (U//F@-GO) SPECIFIC PROCEDURES FOR FISA 


(U//FE66) FISA related initiation and renewal procedures are contained within the FISA 
Initiation Form which can be found aes on the Forms section of the NSLB 
libra 


18.7.3.2.5.1 (U//IFOEO) FISA VERIFICATION OF ACCURACY PROCEDURES 
U// b7E 


U/FECO 


(U/2OCO 


» urso] 


2) (U// 
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3) (U/, 


B) (U//FOVO; 


18.7.3.2.5.2 (U) USE OF FISA DERIVED INFORMATION IN OTHER PROCEEDINGS 


(U//FƏ¥89) There are statutory (50 U.S.C. Sections 1806, 1825, and 1845) and Attorney 
General (AG) policy restrictions on the use of information derived from a FISA ELSUR, 
physical search, or PR/TT. These restrictions apply to and must be followed by anyone 
“who may seek to use or disclose FISA information in any trial, hearing, or other 
proceeding in or before any court, department, officer, agency, regulatory body, or other 
authority of the United States. . . .” See DIOG Appendix E for the AG Memo, Revised 
Policy on the Use or Disclosure of FISA Information, dated 01-10-2008. The guidance in 
the AG’s Memo establishes notification/approval procedures which must be strictly 
followed. Though not contained in the AG Memo, FBI policy requires that 


(U//FE8®) The United States must, prior to the trial, hearing, or other proceeding or at a 
reasonable time prior to an effort to disclose or use that information or submit it into 
evidence, notify the “aggrieved person” [as defined in 50 U.S.C. Sections 1801(k), 
1821(2), or 1841(2)], and the court or other authority in which the information is to be 
disclosed or used, that the United States intends to disclose or use such information. See 
50 U.S.C. Sections 1806(c), 1825(d), and 1845(c). 


18.7.3.2.5.3 (U/AFQUQ) FISA ELECTRONIC SURVEILLANCE ADMINISTRATIVE 
(FISA ELSUR) SusB-FILE 


U//FOLO 
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Du >S 
18.7.3.2.5.4 (U//FOUO) FISA REVIEW BOARD 


U//FOYO b7E 


VFO oo ë 


a Yd 


S El 


18.7.3.2.5.4.1 (U) APPEALING THE DECISION OF THE REVIEW BOARD 
U//FORO 


18.7.3.2.6 (U) NOTICE AND REPORTING REQUIREMENTS FOR FISA 


18.7.3.2.7 (U) COMPLIANCE AND MONITORING FOR FISA 
(U//FORO) b7E 


18.7.3.2.8 (U) SPECIAL CIRCUMSTANCES FOR FISA 


(U) Under 50 U.S.C. § 1802, the President, through the Attorney General, may authorize 
electronic surveillance under FISA without a court order for periods of up to one year, if the 
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Attorney General certifies in writing under oath that the surveillance will be solely directed at 
acquiring communications that are transmitted by means that are exclusively between or 
among foreign powers and there is no substantial likelihood of the surveillance acquiring the 
contents of communications to which USPERs are patties. 


18.7.3.2.9 (U) FISA OVERCOLLECTION 


b7E 


or guidance regarding the handling of any overcolecton. 
18.7.3.2.10 (U) OTHER APPLICABLE POLICIES 
18.7.3.2.10.1 (U) FISA 
A) (U//FOUO) Counterintelligence Division Policy Guide, 071 7BPG 
B) (U//PORO) ©: i i 3 
C) (U/FOUD) Investigative Law Unit Library 
D) (U//FOR®S) Foreign Intelligence Surveillance Act (FISA Unit 


18.7.3.2.11 (U)COLLECTION HANDLING 


(U//FEES) All ELSUR downloading, processing, and handling of original, derivative, and 

copies of original or derivative ELSUR evidence must be conducted by an ELSUR operations 
technician (EOT) or other designated official (e.g. an agent who has successfully completed BIE 
ELSUR training in Virtual Academy). ELSUR evidence must not be uploaded itd] 


18.7.3.2.11.1 (U) DOWNLOADING, HANDLING, AND STORAGE OF FISA 
INTERCEPT MEDIA FOR USE AS ORIGINAL EVIDENCE 


U/A b7E 


(U/ FOGO) 


U/L 


18-199 Version Dated: 
UNCLASSIFIED — FOR-OFFICIAE CSE ONLY March 3, 2016 


UNCLASSIFIED — POR-OFFICEAL-OSE-ONEY 
Domestic Investigations and Operations Guide 


(U//FOGS)| 


1) (UFOS; 


2) (U 


3)_(U//POUO) 
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18.7.3.3 (U) FISA TITLE VII (ACQUISITION OF FOREIGN INTELLIGENCE INFORMATION) 


8.7.3.3.1 (U) SUMMARY 


(U) Titles I and III of the FISA (codified as 50 U.S.C. §§ 1801, et seq.) provide the standard, 
traditional methods of collection against agents of foreign powers (including USPERs and 
non-USPERs) and foreign establishments inside the United States. Title VII of FISA, 
“Additional Procedures Regarding Certain Persons Outside the United States,” provides the 


means 


to target non-USPERs reasonably believed to be located outside the United States. 
8.7.3.3.2 (U) LEGAL AUTHORITY 


A) (U) FISA Amendments Act of 2008 (122 Stat 2436) 
B) (U) AGG-Dom, Part V.A.13 


8.7.3.3.3 (U) DEFINITION OF INVESTIGATIVE METHOD 


(U) Title VII may be used for conducting FISAs on certain persons located outside the United 


States. 


8.7.3.3.4 (U//FOG@) STANDARDS FOR USE AND APPROVAL REQUIREMENTS FOR 
INVESTIGATIVE METHOD 


(U//FOBE) See requirements under DIOG Sections 18.7.1, 18.7.2, and 18.7.3 and 
requirements specified above. 


8.7.3.3.5 (U) DURATION OF APPROVAL 


(U//FO8O) See requirements under DIOG Sections 18.7.1, 18.7.2, and 18.7.3 above. 


(U) Thi 


8.7.3.3.6 (U//FO-YLQ) SPECIFIC COLLECTION PROCEDURES FOR TITLE VII 
e relevant procedures (or collections) under Title VII are: 


18.7.3.3.6.1 (U) SECTION 702 - PROCEDURES FOR TARGETING Non-U.S. 
PERSONS (NON-USPERS) WHO ARE OUTSIDE THE UNITED STATES 


(U/2O88) Under Section 702, the Government has the authority to target non-USPERs 
who are located outside the United States if the collection is effected with the assistance 


of 


an electronic communication service provider, as that term is defined in FISA. This 


section does not require a traditional FISA request. Rather, under this section, the 


At 
up 


torney General and the Director of National Intelligence may authorize, for periods of 
to one year, the targeting of non-United States persons reasonably believed to be 


located outside the United States to acquire foreign intelligence information, provided 
they execute a Certification that is submitted to and approved by the FISC. The 
Certifications are accompanied by an affidavit signed by the FBI Director. In addition, 
the FBI is required to file "Targeting Procedures" that ensure that only non-U.S. persons 
(non-USPERs) reasonably believed to be located outside the United States will be 
targeted for collection and "to prevent the intentional acquisition of any communications 


as 


to which the sender and all intended recipients are known at the time of the acquisition 


to be located in the United States." Additionally, the statute prohibits targeting any person 
reasonably believed to be located outside the United States for the purpose of obtaining 
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the communications of a particular, known person reasonably believed to be in the United 
States. Finally, the FBI is also required to follow 702-specific minimization procedures. 


18.7.3.3.6.2 (U) SECTION 703 - CERTAIN ACQUISITIONS INSIDE THE UNITED 
STATES TARGETING UNITED STATES PERSONS OUTSIDE THE 
UNITED STATES 


(U/FOH6} Under Section 703, the Government has the authority to target USPERs who 
are reasonably believed to be located outside the United States if the collection is effected 
with the assistance of a United States provider and if the collection occurs inside the 
United States. This section only authorizes electronic surveillance or the acquisition of 
stored electronic communications or stored electronic data that requires a court order, 
e.g., non-consensual collection. FISA 703 is an alternative to traditional FISA electronic 
surveillance (Title I) or physical search (Title III) authority when the facts meet the 703 
criteria. There are two notable differences between Section 703 and traditional FISA 
authorities. First, although the application must identify any electronic communication 
service provider necessary to effect the acquisition, the application is not required to 
identify the specific facilities, places, premises, or property at which the acquisition will 
be directed. Second, Section 703 allows for the targeting of a USPER who is “an officer 
or employee of a foreign power,” even if the target is not knowingly engaging in 
clandestine intelligence gathering activities, sabotage, or international terrorism. To 
obtain authority to collect information under this section, the FBI must submit a FISA 
request and obtain a FISC order and secondary orders, as needed. The process to obtain 
that order is the same as the standard FISA process. Refer to the FISA Unit's website for 
further information. Section 703 also allows for emergency authorization. Unlike 
traditional FISA orders, however, surveillance authorized pursuant to this section must 
cease immediately if the target enters the United States. If the FBI wishes to continue 
surveillance of the USPER while he or she is in the United States, the FBI must obtain a 
separate court order under Title I (electronic surveillance) and/or Title HI (physical 
search) of FISA in order to conduct electronic surveillance or a physical search of that 
USPER while the person is located in the United States. The use of any information 
collected using FISA 703 authority must comply with the applicable minimization 
procedures. 


18.7.3.3.6.3 (U) SECTION 704 - OTHER ACQUISITIONS TARGETING UNITED 
STATES PERSONS OUTSIDE THE UNITED STATES 


(U/HFOUO) Under Section 704, the Government has the authority to target USPERs who 
are reasonably believed to be located outside the United States if the collection occurs 
outside the United States (i.e. without the assistance of a United States’ electronic 
communication service provider). The statute requires that the FISA court issue an order 
finding probable cause to believe that the USPER target is a foreign power, an agent of a 
foreign power, or an officer or employee of a foreign power and is reasonably believed to 
be located outside the United States "under circumstances in which the targeted United 
States person has a reasonable expectation of privacy and a warrant would be required if 
the acquisition were conducted in the United States for law enforcement purposes.” To 
obtain authority to collect information under this section, the FBI must submit a FISA 
request and obtain a FISC order (the order will not include secondary orders). The 
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process to obtain a FISA 704 order is similar to, but more streamlined than, that for 
obtaining a traditional FISA under the standard FISA process. There are two notable 
differences between Section 704 and traditional FISA authorities. First, the application is 
not required to identify the specific facilities, places, premises, or property at which the 
acquisition will be directed. Second, Section 704 allows for the targeting of “an officer or 
employee of a foreign power” even if the target is not knowingly engaging in clandestine 
intelligence gathering activities, sabotage, or international terrorism. Refer to the FISA 
Unit's intranet website for further information. Section 704 also allows for emergency 
authorization. Unlike traditional FISA orders, however, surveillance authorized pursuant 
to this section must cease if the USPER enters the United States but may be re-started if 
the person is again reasonably believed to be outside the United States during the 
authorized period of surveillance. If there is a need to continue surveillance while the 
target is located inside the United States a separate court order must be obtained. The use 
of any information collected using FISA 704 authority must comply with the applicable 
minimization procedures. 


(UFOO b7E 


18.7.3.3.6.4 (U) SECTION 705 - JOINT APPLICATIONS AND CONCURRENT 
AUTHORIZATIONS 


(U/ÆOUO) Section 705(a) “joint applications” allow the FISC, upon request of the FBI, 
to approve a joint application targeting an USPER under both Sections 703 and 704 
(authority to collect both when the facilities are located inside and outside the United 
States). 


(U//FEB8) Section 705(b) provides that if an order has been obtained under Section 105 
(electronic surveillance under Title I of FISA) or 304 (physical search under Title III of 
FISA), the Attorney General may authorize the targeting of the USPER target while such 
person is reasonably believed to be located outside the United States. The Attorney 
General has this authority under E.O. 12333 § 2.5. In other words, when the FISA Court 
authorizes surveillance of an USPER target, the Attorney General, under Section 705(b) 
and E.O 12333 § 2.5, can simultaneously authorize surveillance to continue if the target 
travels outside the United States during the authorized period of the surveillance. 
According to Section 705(b), there is no need for a separate order pursuant to Section 703 
or 704. During the FISA drafting process, an FBI employee should determine whether 
surveillance or physical search may occur for purpose of acquiring foreign intelligence 
while the person is reasonably believed to be outside the United States. If so, the FBI 
employee should consult with an OGC or DOJ-NSD attorney to ensure that appropriate 
language is added to the application. 
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